PT-2006-1282 · Wordcircle · Wordcircle

Aliaksandr Hartsuyeu · Published 2006-01-13 · Updated 2018-10-19 · CVE-2006-0205

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wordcircle version 2.17

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication via the password field in the login action to "index.php" (involving v login.php and s user.php). It may also have other unknown impact via certain other fields in unspecified scripts.

Recommendations For Wordcircle version 2.17, consider restricting access to the login action in "index.php" and validating user input in the password field to prevent SQL injection attacks. As a temporary workaround, restrict access to v login.php and s user.php to minimize the risk of exploitation. Avoid using user-supplied input in SQL queries until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2006-0205

Affected Products

Wordcircle

References · 13

• 🔥 http://osvdb.org/22358 · Exploit
• 🔥 http://evuln.com/vulns/27/summary.html · Exploit
• 🔥 http://evuln.com/vulns/28/summary.html · Exploit
• http://secunia.com/advisories/18440 · Vendor Advisory
• http://vupen.com/english/advisories/2006/0185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0205 · Security Note
• http://securityreason.com/securityalert/345 · Note
• http://securityfocus.com/archive/1/421746/100/0/threaded · Note
• http://securityfocus.com/bid/16227 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24105 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24108 · Note
• http://securityfocus.com/archive/1/421745/100/0/threaded · Note
• http://securityreason.com/securityalert/346 · Note