PT-2006-5611 · Clickblog · Clickblog

Ajann · Published 2006-09-19 · Updated 2018-10-17 · CVE-2006-4857

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ClickBlog version 2.0

Description The issue concerns a SQL injection vulnerability in the default.asp login page. This vulnerability allows remote attackers to execute arbitrary SQL commands by manipulating the username and form codeword (also known as the Password field) parameters in the login form.

Recommendations For ClickBlog version 2.0, consider restricting access to the default.asp login page until a fix is available, and avoid using the username and form codeword parameters in a way that could facilitate SQL injection attacks.

Exploit

Fix

Related Identifiers

CVE-2006-4857

Affected Products

Clickblog

References · 8

• 🔥 https://exploit-db.com/exploits/28577 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4857 · Security Note
• http://secunia.com/advisories/21980 · Vendor Advisory
• http://securityfocus.com/archive/1/446074/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/3662 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28964 · Note
• http://securityreason.com/securityalert/1599 · Note
• http://securityfocus.com/bid/20033 · Note