PT-2006-6903 · Expinion.Net · Inews Publisher

Security Curmudgeon + 1 · Publicado 2006-12-04 · Atualizado 2018-10-17 · CVE-2006-6274

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Expinion.net iNews (iNP) Publisher versions 2.5 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands via the ex parameter in the articles.asp file. Initial reports incorrectly identified this as a cross-site scripting (XSS) issue, but it was later determined to be a SQL injection vulnerability. The vulnerability was initially reported for News Manager, but evidence suggests that the correct affected product is Publisher.

Recommendations For versions 2.5 and earlier, consider restricting access to the articles.asp file until a fix is available. As a temporary workaround, avoid using the ex parameter in the articles.asp file to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2006-6274

Produtos afetados

Inews Publisher

Referências · 9

• 🔥 http://aria-security.com/forum/showthread.php?t=40 · Exploit
• 🔥 http://securityfocus.com/bid/21296 · Exploit
• http://securityreason.com/securityalert/1956 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6274 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30510 · Nota
• http://attrition.org/pipermail/vim/2006-November/001147.html · Nota
• http://vupen.com/english/advisories/2006/4707 · Nota
• http://securityfocus.com/archive/1/452572/100/0/threaded · Nota
• http://secunia.com/advisories/23123 · Aviso do Fabricante