PT-2006-4805 · X Scripts · X-Scripts X-Protection

Published 2006-08-01 · Updated 2017-07-20 · CVE-2006-3959

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions X-Scripts X-Protection version 1.10

Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved through a SQL injection vulnerability in the protect.php file, specifically when magic quotes gpc is disabled. The vulnerability can be exploited via the username and password parameters.

Recommendations For X-Scripts X-Protection version 1.10, consider disabling the protect.php file or restricting access to it until a patch is available. As a temporary workaround, enable magic quotes gpc to prevent SQL injection attacks. Avoid using the username and password parameters in the protect.php file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-3959

Affected Products

X-Scripts X-Protection

References · 8

• 🔥 http://downloads.securityfocus.com/vulnerabilities/exploits/x-protection_poc.txt · Exploit
• 🔥 https://exploit-db.com/exploits/28303 · Exploit
• 🔥 http://securityfocus.com/bid/19235 · Exploit
• http://secunia.com/advisories/21282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3959 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28088 · Note
• http://osvdb.org/27635 · Note
• http://vupen.com/english/advisories/2006/3060 · Note