PT-2006-5506 · Sql Ledger+1 · Sql-Ledger+1

Chris Murtagh + 2 · Published 2006-09-13 · Updated 2018-10-17 · CVE-2006-4731

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SQL-Ledger versions prior to 2.6.19 LedgerSMB versions prior to 1.0.0p1

Description The issue allows remote attackers to execute arbitrary Perl code via an unspecified terminal parameter value containing ../ (dot dot slash) in the login.pl and admin.pl files.

Recommendations For SQL-Ledger versions prior to 2.6.19, update to version 2.6.19 or later. For LedgerSMB versions prior to 1.0.0p1, update to version 1.0.0p1 or later.

Exploit

Fix

Related Identifiers

CVE-2006-4731

DSA-1239-1

Affected Products

Ledgersmb

Sql-Ledger

References · 16

• 🔥 https://exploit-db.com/exploits/28514 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2006-4731 · Vendor Advisory
• http://secunia.com/advisories/21824 · Vendor Advisory
• http://sourceforge.net/project/shownotes.php?group_id=175965&release_id=446778 · Patch
• https://osv.dev/vulnerability/CVE-2006-4731 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4731 · Vendor Advisory
• http://secunia.com/advisories/21886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4731 · Security Note
• http://securityfocus.com/archive/1/445817/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/3555 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28885 · Note
• http://sql-ledger.org/cgi-bin/nav.pl?page=news.html&title=What%27s%20New · Note
• http://vupen.com/english/advisories/2006/3554 · Note
• http://securityfocus.com/bid/19960 · Note
• http://svn.sourceforge.net/viewvc/ledger-smb/trunk/login.pl?r1=53&r2=69 · Note