PT-2006-6970 · Unknown · Online-Bookmarks

Publicado 2006-12-07 · Atualizado 2017-07-29 · CVE-2006-6358

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions online-bookmarks version 0.6.12

Description A SQL injection issue exists in the login function, allowing remote attackers to execute arbitrary SQL commands. This can be achieved via the username and possibly the password parameter.

Recommendations For version 0.6.12, consider disabling the login function until a patch is available. Restrict access to the auth.inc file to minimize the risk of exploitation. Avoid using the username and password parameters in the affected login function until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-6358

Produtos afetados

Online-Bookmarks

Referências · 7

• http://securityfocus.com/bid/21422 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30696 · Nota
• http://marc.info/?l=bugtraq&m=116525508018486&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6358 · Nota de Segurança
• http://vigilon.com/resources/120406.html · Nota
• http://secunia.com/advisories/23169 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/4849 · Nota