PT-2006-4687 · Bmachine · Boastmachine

Darkfig · Published 2006-07-25 · Updated 2018-10-17 · CVE-2006-3828

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions boastMachine (formerly bMachine) versions 3.1 and earlier

Description The issue allows remote authenticated administrators to bypass SQL injection protection mechanisms. This is possible because the product does not filter certain characters and keywords, such as commas, quote characters, pound sign (#) characters, UNION, and SELECT. The product only checks for specific keywords like "insert," "delete," "update," and "replace."

Recommendations For boastMachine (formerly bMachine) versions 3.1 and earlier, as a temporary workaround, consider restricting access to SQL functionality for remote authenticated administrators until a patch is available. Additionally, avoid using sensitive SQL queries that could be exploited by the bypass of SQL injection protection mechanisms. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-3828

Affected Products

Boastmachine

References · 8

• 🔥 http://acid-root.new.fr/advisories/boastmachine.txt · Exploit
• http://secunia.com/advisories/21066 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3828 · Security Note
• http://securityreason.com/securityalert/1252 · Note
• http://vupen.com/english/advisories/2006/2849 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3828 · Note
• http://securityfocus.com/archive/1/440306/100/0/threaded · Note
• http://securitytracker.com/id?1016515 · Note