PT-2006-4030 · Cms Mundo · Cms Mundo

Andreas Sandblad · Published 2006-07-13 · Updated 2017-07-20 · CVE-2006-3135

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CMS Mundo version 1.0 build 008

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several parameters and fields, including the news id parameter in the news module, searchstring parameter in the search module, id parameter in the webshop module, username parameter in index.php, and various fields during a user profile update, such as Name, Address, Zip, City, Country, and Email.

Recommendations For CMS Mundo version 1.0 build 008, consider restricting access to the news, search, and webshop modules, and limit user profile updates until a fix is available. As a temporary workaround, avoid using the news id, searchstring, id, and username parameters in their respective modules, and be cautious with user input in the Name, Address, Zip, City, Country, and Email fields during user profile updates.

Exploit

Fix

Related Identifiers

CVE-2006-3135

Affected Products

Cms Mundo

References · 11

• 🔥 http://secunia.com/advisories/20589 · Exploit
• http://secunia.com/secunia_research/2006-52/advisory · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3135 · Security Note
• http://osvdb.org/27140 · Note
• http://osvdb.org/27141 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27712 · Note
• http://osvdb.org/27139 · Note
• http://osvdb.org/27142 · Note
• http://osvdb.org/27143 · Note
• http://vupen.com/english/advisories/2006/2783 · Note
• http://securityreason.com/securityalert/1236 · Note