PT-2006-2654 · Softbiz · Softbiz Image Gallery

Published 2006-04-07 · Updated 2018-10-18 · CVE-2006-1659

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Softbiz Image Gallery (affected versions not specified)

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through several parameters in different files, including the id parameter in "image desc.php", the provided parameter in "template.php", the cid parameter in "suggest image.php" and "images.php", and the img id parameter in "insert rating.php".

Recommendations: For the id parameter in "image desc.php", avoid using it until a fix is available. For the provided parameter in "template.php", restrict its use to minimize risk. For the cid parameter in "suggest image.php" and "images.php", consider disabling these parameters temporarily. For the img id parameter in "insert rating.php", refrain from using it until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-1659

Affected Products

Softbiz Image Gallery

References · 16

• 🔥 https://exploit-db.com/exploits/27544 · Exploit
• 🔥 http://securityfocus.com/bid/17339 · Exploit
• 🔥 https://exploit-db.com/exploits/27542 · Exploit
• 🔥 https://exploit-db.com/exploits/27543 · Exploit
• 🔥 https://exploit-db.com/exploits/27546 · Exploit
• 🔥 https://exploit-db.com/exploits/27545 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1659 · Security Note
• http://secunia.com/advisories/19523 · Vendor Advisory
• http://osvdb.org/24369 · Note
• http://osvdb.org/24372 · Note
• http://osvdb.org/24371 · Note
• http://vupen.com/english/advisories/2006/1217 · Note
• http://osvdb.org/24368 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25616 · Note
• http://securityfocus.com/archive/1/429763/100/0/threaded · Note