PT-2006-3136 · Plogger · Plogger

Published 2006-05-03 · Updated 2017-07-20 · CVE-2006-2157

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Plogger versions prior to Beta 2.1

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the id parameter in the "gallery.php" file when the level is set to "slideshow".

Recommendations For versions prior to Beta 2.1, avoid using the id parameter in the "gallery.php" file when the level is set to "slideshow" until a fix is available. Consider restricting access to the "gallery.php" file to minimize the risk of exploitation.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2006-2157

Affected Products

Plogger

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-2157 · Security Note
• http://retrogod.altervista.org/plogger_b21_sql_xpl.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26273 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2157 · Note