PT-2006-3519 · Dgbook · Dgbook

Published 2006-05-24 · Updated 2017-07-20 · CVE-2006-2573

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DGBook version 1.0

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is possible via the name, email, homepage, address, comment, and ip parameters in index.php when magic quotes gpc is disabled.

Recommendations For DGBook version 1.0, consider disabling the use of the vulnerable parameters (name, email, homepage, address, comment, and ip) in index.php until a patch is available. Additionally, enabling magic quotes gpc can help mitigate this issue.

Fix

Related Identifiers

CVE-2006-2573

Affected Products

Dgbook

References · 5

• http://secunia.com/advisories/20201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2573 · Security Note
• http://vupen.com/english/advisories/2006/1942 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26630 · Note
• http://osvdb.org/25733 · Note