PT-2006-1943 · Vcs · Vcs Virtual Program Management Intranet (Vpmi) Enterprise

Steven M. Christey · Published 2006-02-25 · Updated 2024-08-07 · CVE-2006-0897

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions VCS Virtual Program Management Intranet (VPMi) Enterprise version 3.3

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to "Service Requests.asp". The vendor has disputed this issue, stating that their complex state management system protects against this type of SQL injection. However, further investigation suggests that the original researcher might have triggered errors using invalid field values, which is not proof of SQL injection.

Recommendations For version 3.3, as a temporary workaround, consider restricting access to the "Service Requests.asp" endpoint until the issue is resolved. Avoid using the UpdateID0 parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2006-0897

Affected Products

Vcs Virtual Program Management Intranet (Vpmi) Enterprise

References · 9

• http://vupen.com/english/advisories/2006/0725 · Vendor Advisory
• http://secunia.com/advisories/18842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0897 · Security Note
• https://t.me/cvenotify/89758 · Telegram Post
• http://attrition.org/pipermail/vim/2006-March/000598.html · Note
• http://securityfocus.com/bid/16798 · Note
• http://attrition.org/pipermail/vim/2006-March/000599.html · Note
• http://osvdb.org/23479 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24885 · Note