PT-2006-3245 · Saphplesson · Saphplesson

O Y 6 Hotmail Com · Published 2006-05-09 · Updated 2018-10-18 · CVE-2006-2279

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SaphpLesson version 3.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the Find parameter in the "search.php" API endpoint, and the LID and Rate parameters in the "misc.php" API endpoint.

Recommendations For SaphpLesson version 3.0, consider restricting access to the "search.php" and "misc.php" API endpoints until a patch is available. As a temporary workaround, avoid using the Find, LID, and Rate parameters in these endpoints to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-2279

Affected Products

Saphplesson

References · 9

• http://secunia.com/advisories/20034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2279 · Security Note
• http://osvdb.org/25362 · Note
• http://securityfocus.com/bid/17848 · Note
• http://vupen.com/english/advisories/2006/1708 · Note
• http://securityfocus.com/archive/1/433052/100/0/threaded · Note
• http://securityreason.com/securityalert/862 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26293 · Note
• http://osvdb.org/25363 · Note