PT-2006-6575 · Unknown · Yet Another News System

Navairum · Published 2006-11-15 · Updated 2017-07-20 · CVE-2006-5908

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yet Another News System (YANS) version 0.2b

Description The issue concerns SQL injection vulnerabilities in the login user function. Remote attackers can execute arbitrary SQL commands via the username or password parameter.

Recommendations For Yet Another News System (YANS) version 0.2b, consider disabling the login user function in yans.func.php until a patch is available to prevent exploitation of the SQL injection vulnerabilities. Restrict access to the login functionality to minimize the risk of arbitrary SQL command execution. Avoid using the username and password parameters in the affected function until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5908

Affected Products

Yet Another News System

References · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2006-11/0121.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5908 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30119 · Note
• http://securityreason.com/securityalert/1866 · Note
• http://securityfocus.com/bid/20963 · Note