PT-2006-3900 · Unknown · My Photo Scrapbook

Publicado 2006-06-13 · Atualizado 2017-07-20 · CVE-2006-2993

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions My Photo Scrapbook versions 1.0 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the key parameter in the following API endpoints: "Displayview.asp" and "Details Photo bv.asp".

Recommendations For My Photo Scrapbook versions 1.0 and earlier, consider restricting access to the "Displayview.asp" and "Details Photo bv.asp" endpoints until a patch is available. As a temporary workaround, avoid using the key parameter in these affected API endpoints to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-2993

Produtos afetados

My Photo Scrapbook

Referências · 8

• http://vupen.com/english/advisories/2006/2244 · Nota
• http://osvdb.org/26281 · Nota
• http://pridels0.blogspot.com/2006/06/my-photo-scrapbook-vuln.html · Nota
• http://secunia.com/advisories/20554 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27087 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2993 · Nota de Segurança
• http://osvdb.org/26282 · Nota
• http://securityfocus.com/bid/18418 · Nota