PT-2006-1659 · Hinton Design · Phphg Guestbook

Aliaksandr Hartsuyeu · Published 2006-02-08 · Updated 2018-10-19 · CVE-2006-0602

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hinton Design phphg Guestbook version 1.2

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the username parameter to "check.php" or the id parameter to several admin endpoints, including "admin/edit smilie.php", "admin/add theme.php", "admin/ban ip.php", "admin/add lang.php", or "admin/edit filter.php".

Recommendations For Hinton Design phphg Guestbook version 1.2, consider restricting access to the mentioned admin endpoints and validating user input for the username and id parameters to prevent SQL injection attacks. As a temporary workaround, avoid using the username parameter in "check.php" and the id parameter in the affected admin endpoints until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2006-0602

Affected Products

Phphg Guestbook

References · 7

• 🔥 http://evuln.com/vulns/58/summary.html · Exploit
• 🔥 http://securitytracker.com/id?1015620 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0602 · Security Note
• http://vupen.com/english/advisories/2006/0480 · Vendor Advisory
• http://secunia.com/advisories/18758 · Vendor Advisory
• http://securityfocus.com/archive/1/424740/100/0/threaded · Note
• http://securityfocus.com/bid/16541 · Note