PT-2006-2942 · Wwwthreads · Wwwthreads Rc 3

D3Vil-0X1 + 1 · Published 2006-04-21 · Updated 2018-10-18 · CVE-2006-1958

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions WWWThreads RC 3

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via two methods:

1. the forumreferrer cookie to register.php
2. the messages parameter in message list.php.

Recommendations For WWWThreads RC 3, update the software to prevent SQL injection attacks, specifically by validating and sanitizing user input for the forumreferrer cookie and the messages parameter. As a temporary workaround, consider restricting access to register.php and message list.php to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1958

Affected Products

Wwwthreads Rc 3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-1958 · Security Note
• http://securityfocus.com/bid/17615 · Note
• http://vupen.com/english/advisories/2006/1447 · Note
• http://securityreason.com/securityalert/739 · Note
• http://securityfocus.com/archive/1/431400/100/0/threaded · Note
• http://secunia.com/advisories/19732 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25936 · Note