PT-2006-1896 · Ilchclan · Ilchclan

Published 2006-02-23 · Updated 2017-07-20 · CVE-2006-0850

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ilchClan versions prior to 1.05g

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the login name parameter in the include/includes/user/login.php file.

Recommendations For versions prior to 1.05g, update to version 1.05g or later to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation. Avoid using the login name parameter in the affected login endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2006-0850

Affected Products

Ilchclan

References · 6

• http://secunia.com/advisories/18951 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0850 · Security Note
• http://ilch.de/news-134.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24830 · Note
• http://osvdb.org/23370 · Note
• http://vupen.com/english/advisories/2006/0676 · Note