PT-2006-3490 · Unknown · Xtreme Topsites

Published 2006-05-23 · Updated 2011-03-08 · CVE-2006-2544

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xtreme Topsites version 1.1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the searchthis parameter in "lostid.php" and the id parameter in "stats.php", particularly when magic quotes gpc is disabled.

Recommendations For Xtreme Topsites version 1.1, consider disabling the searchthis parameter in "lostid.php" and the id parameter in "stats.php" until a fix is available. Additionally, enabling magic quotes gpc may help mitigate the risk of SQL injection attacks.

Fix

Related Identifiers

CVE-2006-2544

Affected Products

Xtreme Topsites

References · 4

• http://secunia.com/advisories/20192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2544 · Security Note
• http://osvdb.org/25703 · Note
• http://vupen.com/english/advisories/2006/1899 · Note