PT-2006-3894 · Dominios Europa · Dominios Europa Picrate

Published 2006-06-13 · Updated 2017-07-20 · CVE-2006-2987

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dominios Europa PICRATE (aka TAL RateMyPic) version 1.0

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters to specific API endpoints, including id, voteid, and vfiel parameters to "index.php", and nick, email, city, messen, and message form field parameters to "add.php".

Recommendations For Dominios Europa PICRATE (aka TAL RateMyPic) version 1.0, consider restricting access to the "index.php" and "add.php" endpoints until a patch is available. As a temporary workaround, avoid using the id, voteid, vfiel, nick, email, city, messen, and message parameters in the affected API endpoints.

Fix

Related Identifiers

CVE-2006-2987

Affected Products

Dominios Europa Picrate

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2006-2987 · Security Note
• http://secunia.com/advisories/20414 · Vendor Advisory
• http://vupen.com/english/advisories/2006/2118 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27017 · Note