PT-2006-5059 · Sql Ledger · Sql-Ledger

Chris Travers · Publicado 2006-08-31 · Atualizado 2018-10-17 · CVE-2006-4244

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SQL-Ledger versions 2.4.4 through 2.6.17

Description The issue allows remote attackers to gain access as any logged-in user. This is achieved by setting the sql-ledger-[username] cookie and the sessionid parameter to the same value, thereby bypassing user authentication.

Recommendations For SQL-Ledger versions 2.4.4 through 2.6.17, as a temporary workaround, consider implementing additional authentication measures to verify user sessions, such as validating the sessionid parameter against a server-side stored value to prevent tampering. Restrict access to sensitive areas of the application until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2006-4244

DSA-1239-1

Produtos afetados

Sql-Ledger

Referências · 11

• 🔥 http://securityfocus.com/archive/1/445512 · Exploit
• http://securityreason.com/securityalert/1472 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4244 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2006-4244 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2006-4244 · Aviso do Fabricante
• http://secunia.com/advisories/21689 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28671 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4244 · Nota de Segurança
• http://securityfocus.com/bid/19758 · Nota
• http://sql-ledger.org/cgi-bin/nav.pl?page=news.html&title=What%27s%20New · Nota
• http://securityfocus.com/archive/1/444741/100/0/threaded · Nota