PT-2006-4165 · Softbiz · Softbiz Dating

Published

2006-06-28

·

Updated

2018-10-18

·

CVE-2006-3271

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Softbiz Dating version 1.0
Description The issue allows remote attackers to execute SQL commands, potentially leading to data manipulation or extraction. This is achieved through SQL injection vulnerabilities in several parameters across different PHP files. Specifically, the vulnerabilities are found in the country and sort by parameters in "search results.php", the browse parameter in "featured photos.php", and the cid parameter in "products.php", "index.php", and "news desc.php". API Endpoints:
  • "search results.php"
  • "featured photos.php"
  • "products.php"
  • "index.php"
  • "news desc.php" Vulnerable Parameters or Variables:
  • country
  • sort by
  • browse
  • cid
Recommendations For Softbiz Dating version 1.0, as a temporary workaround, consider restricting access to the vulnerable parameters country, sort by, browse, and cid in the affected PHP files until a patch is available. Avoid using these parameters in the respective API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2006-3271

Affected Products

Softbiz Dating