PT-2006-3915 · Obm · Open Business Management

Published 2006-06-13 · Updated 2017-07-20 · CVE-2006-3010

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Open Business Management (OBM) version 1.0.3 pl1

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via multiple parameters to various API endpoints, including new order and order dir parameters to endpoints such as "index.php", "group/group index.php", "user/user index.php", "list/list index.php", and "company/company index.php", as well as the entity and tf dateafter parameters to "company/company index.php".

Recommendations For Open Business Management (OBM) version 1.0.3 pl1, consider restricting access to the vulnerable API endpoints, such as "index.php", "group/group index.php", "user/user index.php", "list/list index.php", and "company/company index.php", until a patch is available. Avoid using the new order, order dir, entity, and tf dateafter parameters in the affected endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3010

Affected Products

Open Business Management

References · 10

• 🔥 http://osvdb.org/26207 · Exploit
• 🔥 http://osvdb.org/26206 · Exploit
• 🔥 http://osvdb.org/26203 · Exploit
• 🔥 http://securityfocus.com/bid/18348 · Exploit
• 🔥 http://osvdb.org/26205 · Exploit
• 🔥 http://osvdb.org/26204 · Exploit
• http://secunia.com/advisories/20486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3010 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27030 · Note
• http://pridels0.blogspot.com/2006/06/obm-multiple-sql-inj-and-xss-vuln.html · Note