PT-2006-4009 · Chipmailer · Chipmailer

Tamriel · Published 2006-06-21 · Updated 2017-07-20 · CVE-2006-3111

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Chipmailer version 1.09

Description The issue allows remote attackers to execute arbitrary SQL commands via multiple parameters in the main.php file. The vulnerable parameters include anfang, name, mail, anrede, vorname, nachname, gebtag, gebmonat, and gebjahr.

Recommendations For Chipmailer version 1.09, consider restricting access to the main.php file until a patch is available. As a temporary workaround, avoid using the parameters anfang, name, mail, anrede, vorname, nachname, gebtag, gebmonat, and gebjahr in the affected API endpoint.

Fix

Related Identifiers

CVE-2006-3111

Affected Products

Chipmailer

References · 7

• http://secunia.com/advisories/20643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3111 · Security Note
• http://marc.info/?l=bugtraq&m=115024576618386&w=2 · Note
• http://securitytracker.com/id?1016315 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27158 · Note
• http://securityfocus.com/bid/18463 · Note
• http://vupen.com/english/advisories/2006/2359 · Note