PT-2006-6575 · Unknown · Yet Another News System

Navairum · Publicado 2006-11-15 · Atualizado 2017-07-20 · CVE-2006-5908

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yet Another News System (YANS) version 0.2b

Description The issue concerns SQL injection vulnerabilities in the login user function. Remote attackers can execute arbitrary SQL commands via the username or password parameter.

Recommendations For Yet Another News System (YANS) version 0.2b, consider disabling the login user function in yans.func.php until a patch is available to prevent exploitation of the SQL injection vulnerabilities. Restrict access to the login functionality to minimize the risk of arbitrary SQL command execution. Avoid using the username and password parameters in the affected function until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-5908

Produtos afetados

Yet Another News System

Referências · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2006-11/0121.html · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30119 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5908 · Nota de Segurança
• http://securityreason.com/securityalert/1866 · Nota
• http://securityfocus.com/bid/20963 · Nota