PT-2006-1397 · Webspot · Webspotblogging

Aliaksandr Hartsuyeu · Published 2006-01-19 · Updated 2018-10-19 · CVE-2006-0324

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WebspotBlogging version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands and bypass authentication. This is achieved via the username parameter to the "login.php" endpoint.

Recommendations For WebspotBlogging version 3.0, update to a version that fixes this issue, as using the vulnerable version may allow attackers to bypass authentication and execute arbitrary SQL commands. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-0324

Affected Products

Webspotblogging

References · 13

• 🔥 http://securityfocus.com/bid/16319 · Exploit
• 🔥 http://evuln.com/vulns/41/summary.html · Exploit
• 🔥 https://exploit-db.com/exploits/27114 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0324 · Security Note
• http://securityfocus.com/archive/1/422364/100/0/threaded · Note
• http://securitytracker.com/id?1015522 · Note
• https://sourceforge.net/project/shownotes.php?release_id=387180&group_id=156586 · Note
• http://securityreason.com/securityalert/356 · Note
• http://osvdb.org/22670 · Note
• https://sourceforge.net/forum/forum.php?forum_id=532233 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24222 · Note
• http://vupen.com/english/advisories/2006/0268 · Note
• http://secunia.com/advisories/18560 · Note