PT-2006-4687 · Bmachine · Boastmachine

Darkfig · Publicado 2006-07-25 · Atualizado 2018-10-17 · CVE-2006-3828

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions boastMachine (formerly bMachine) versions 3.1 and earlier

Description The issue allows remote authenticated administrators to bypass SQL injection protection mechanisms. This is possible because the product does not filter certain characters and keywords, such as commas, quote characters, pound sign (#) characters, UNION, and SELECT. The product only checks for specific keywords like "insert," "delete," "update," and "replace."

Recommendations For boastMachine (formerly bMachine) versions 3.1 and earlier, as a temporary workaround, consider restricting access to SQL functionality for remote authenticated administrators until a patch is available. Additionally, avoid using sensitive SQL queries that could be exploited by the bypass of SQL injection protection mechanisms. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2006-3828

Produtos afetados

Boastmachine

Referências · 8

• 🔥 http://acid-root.new.fr/advisories/boastmachine.txt · Exploit
• http://securityreason.com/securityalert/1252 · Nota
• http://vupen.com/english/advisories/2006/2849 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3828 · Nota
• http://securityfocus.com/archive/1/440306/100/0/threaded · Nota
• http://secunia.com/advisories/21066 · Aviso do Fabricante
• http://securitytracker.com/id?1016515 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3828 · Nota de Segurança