PT-2006-5059 · Sql Ledger · Sql-Ledger

Chris Travers · Published 2006-08-31 · Updated 2018-10-17 · CVE-2006-4244

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SQL-Ledger versions 2.4.4 through 2.6.17

Description The issue allows remote attackers to gain access as any logged-in user. This is achieved by setting the sql-ledger-[username] cookie and the sessionid parameter to the same value, thereby bypassing user authentication.

Recommendations For SQL-Ledger versions 2.4.4 through 2.6.17, as a temporary workaround, consider implementing additional authentication measures to verify user sessions, such as validating the sessionid parameter against a server-side stored value to prevent tampering. Restrict access to sensitive areas of the application until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2006-4244

DSA-1239-1

Affected Products

Sql-Ledger

References · 11

• 🔥 http://securityfocus.com/archive/1/445512 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4244 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-4244 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-4244 · Vendor Advisory
• http://secunia.com/advisories/21689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4244 · Security Note
• http://securityreason.com/securityalert/1472 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28671 · Note
• http://securityfocus.com/bid/19758 · Note
• http://sql-ledger.org/cgi-bin/nav.pl?page=news.html&title=What%27s%20New · Note
• http://securityfocus.com/archive/1/444741/100/0/threaded · Note