PT-2006-4461 · Jetbox · Jetbox Cms

Sven Krewitt · Published 2006-08-08 · Updated 2018-10-18 · CVE-2006-3586

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jetbox CMS version 2.1 SR1

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the frontsession COOKIE parameter and the view parameter in "index.php", as well as the login parameter in "admin/cms/index.php".

Recommendations For Jetbox CMS version 2.1 SR1, consider restricting access to the frontsession COOKIE parameter, the view parameter in "index.php", and the login parameter in "admin/cms/index.php" to minimize the risk of exploitation. As a temporary workaround, avoid using these parameters until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-3586

Affected Products

Jetbox Cms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-3586 · Security Note
• http://secunia.com/advisories/20889 · Vendor Advisory
• http://secunia.com/secunia_research/2006-57/advisory · Vendor Advisory
• http://securityfocus.com/archive/1/441980/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28168 · Note
• http://securityfocus.com/bid/19303 · Note
• http://securityreason.com/securityalert/1339 · Note