PT-2006-2798 · Musicbox · Musicbox

Published 2006-04-18 · Updated 2018-10-18 · CVE-2006-1807

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Musicbox versions 2.3.3 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the start parameter in a "search" action or the type parameter in a "top" action.

Recommendations For Musicbox versions 2.3.3 and earlier, update to a version later than 2.3.3 to resolve the issue. As a temporary workaround, consider restricting access to the index.php file or disabling the search and top actions until a patch is available. Avoid using the start and type parameters in the affected actions until the issue is resolved.

Fix

Related Identifiers

CVE-2006-1807

Affected Products

Musicbox

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2006-1807 · Security Note
• http://secunia.com/advisories/19672 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25836 · Note
• http://securityfocus.com/bid/17545 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27926 · Note
• http://vupen.com/english/advisories/2006/1373 · Note
• http://securityfocus.com/archive/1/441000/100/0/threaded · Note
• http://pridels0.blogspot.com/2006/04/musicbox-vuln.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1807 · Note