PT-2006-2686 · Unknown · Mwnewsletter

Published 2006-04-11 · Updated 2011-03-08 · CVE-2006-1692

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: MWNewsletter version 1.0.0b

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the user email parameter to "unsubscribe.php" or "subscribe.php", or the user name parameter to "subscribe.php".

Recommendations: For MWNewsletter version 1.0.0b, avoid using the user email parameter in the "unsubscribe.php" and "subscribe.php" API endpoints, and the user name parameter in the "subscribe.php" endpoint until the issue is resolved. Restrict access to these endpoints to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1692

Affected Products

Mwnewsletter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-1692 · Security Note
• http://secunia.com/advisories/19568 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1270 · Note
• http://osvdb.org/24445 · Note
• http://osvdb.org/24905 · Note