PT-2006-5152 · Cool · Cool Coold.Exe+2

Tan Chew Keong · Published 2006-08-24 · Updated 2017-07-20 · CVE-2006-4347

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cool Manager version 5.0 Cool Messenger Office/School Server version 5.5

Description The issue allows remote attackers to execute arbitrary SQL commands via the username field in the user logon authentication request handling. This is a SQL injection vulnerability in the Cool CoolD.exe component.

Recommendations For Cool Manager version 5.0, update the Cool CoolD.exe component to prevent SQL injection attacks. For Cool Messenger Office/School Server version 5.5, restrict access to the username field in the authentication request handling until a patch is available.

Fix

Related Identifiers

CVE-2006-4347

Affected Products

Cool Manager

Cool Messenger Office/School Server

Cool Coold.Exe

References · 8

• http://secunia.com/advisories/21569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4347 · Security Note
• http://vuln.sg/coolmessenger55-en.html · Vendor Advisory
• http://osvdb.org/28117 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0605.html · Note
• http://securityfocus.com/bid/19669 · Note
• http://vupen.com/english/advisories/2006/3362 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28531 · Note