PT-2006-3682 · Pre · Pre News Manager

K-159 + 1 · Published 2006-06-02 · Updated 2018-10-18 · CVE-2006-2763

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pre News Manager version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the id parameter to "index.php" and the nid parameter to several other scripts, including "news detail.php", "email story.php", "thankyou.php", "printable view.php", "tella friend.php", and "send comments.php".

Recommendations For Pre News Manager version 1.0, consider restricting access to the vulnerable parameters id and nid in the affected scripts until a patch is available. As a temporary workaround, avoid using the id parameter in "index.php" and the nid parameter in the other mentioned scripts.

Exploit

Fix

Related Identifiers

CVE-2006-2763

Affected Products

Pre News Manager

References · 17

• 🔥 https://exploit-db.com/exploits/3841 · Exploit
• 🔥 https://exploit-db.com/exploits/5803 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2763 · Security Note
• http://secunia.com/advisories/20284 · Vendor Advisory
• http://osvdb.org/26075 · Note
• http://osvdb.org/26077 · Note
• http://osvdb.org/26074 · Note
• http://osvdb.org/26076 · Note
• http://securityfocus.com/archive/1/497185/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43070 · Note
• http://securityfocus.com/archive/1/497219/100/0/threaded · Note
• http://osvdb.org/26079 · Note
• http://osvdb.org/26073 · Note
• http://vupen.com/english/advisories/2006/1990 · Note
• http://osvdb.org/26078 · Note