PT-2006-5152 · Cool · Cool Coold.Exe+2

Tan Chew Keong · Publicado 2006-08-24 · Atualizado 2017-07-20 · CVE-2006-4347

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cool Manager version 5.0 Cool Messenger Office/School Server version 5.5

Description The issue allows remote attackers to execute arbitrary SQL commands via the username field in the user logon authentication request handling. This is a SQL injection vulnerability in the Cool CoolD.exe component.

Recommendations For Cool Manager version 5.0, update the Cool CoolD.exe component to prevent SQL injection attacks. For Cool Messenger Office/School Server version 5.5, restrict access to the username field in the authentication request handling until a patch is available.

Correção

Identificadores relacionados

CVE-2006-4347

Produtos afetados

Cool Manager

Cool Messenger Office/School Server

Cool Coold.Exe

Referências · 8

• http://secunia.com/advisories/21569 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-4347 · Nota de Segurança
• http://osvdb.org/28117 · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0605.html · Nota
• http://securityfocus.com/bid/19669 · Nota
• http://vupen.com/english/advisories/2006/3362 · Nota
• http://vuln.sg/coolmessenger55-en.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28531 · Nota