PT-2006-3866 · Snitz · Snitz Forums

Farhadkey · Published 2006-06-12 · Updated 2018-10-18 · CVE-2006-2959

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Snitz Forum versions 3.4.05 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the GROUP parameter in a cookie, specifically through the %strCookieURL%.GROUP parameter.

Recommendations For Snitz Forum versions 3.4.05 and earlier, update to a version later than 3.4.05 to resolve the issue. As a temporary workaround, consider restricting access to the inc header.asp file until a patch is available. Avoid using the GROUP parameter in cookies for the affected versions until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-2959

Affected Products

Snitz Forums

References · 8

• 🔥 http://kapda.ir/advisory-343.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-2959 · Security Note
• http://securityfocus.com/bid/18362 · Note
• http://securitytracker.com/id?1016267 · Note
• http://forum.snitz.com/forum/topic.asp?TOPIC_ID=62049 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27080 · Note
• http://securityreason.com/securityalert/1075 · Note
• http://securityfocus.com/archive/1/436702/100/0/threaded · Note