PT-2006-4485 · Orbitmatrix · Orbitmatrix

Published 2006-07-14 · Updated 2018-10-18 · CVE-2006-3610

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OrbitMATRIX version 1.0

Description The issue allows remote attackers to obtain sensitive information, specifically partial database schema, by modifying the page name parameter in index.php. This modification reflects portions of an SQL query in the result. However, it is unclear whether the exposed information is target-specific.

Recommendations For OrbitMATRIX version 1.0, consider restricting access to the index.php file or modifying the page name parameter handling to prevent SQL query reflection until a proper fix is available. As a temporary workaround, avoid using the page name parameter in the affected endpoint.

Fix

Related Identifiers

CVE-2006-3610

Affected Products

Orbitmatrix

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2006-3610 · Security Note
• http://securityfocus.com/archive/1/439970/100/0/threaded · Note