PT-2006-6825 · Fixit · Fixit Idms Pro Image Gallery

Published 2006-12-01 · Updated 2018-10-17 · CVE-2006-6195

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fixit iDMS Pro Image Gallery (affected versions not specified)

Description The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The exploitation can occur through specific parameters in certain files, including the show id or parentid parameter to "filelist.asp", or the fid parameter to "showfile.asp".

Recommendations For Fixit iDMS Pro Image Gallery, consider restricting access to the "filelist.asp" and "showfile.asp" files until a patch is available. As a temporary workaround, avoid using the show id, parentid, and fid parameters in the affected API endpoints until the issue is resolved. Restrict input to these parameters to minimize the risk of SQL injection attacks.

Exploit

Fix

Related Identifiers

CVE-2006-6195

Affected Products

Fixit Idms Pro Image Gallery

References · 8

• 🔥 https://exploit-db.com/exploits/29179 · Exploit
• 🔥 https://exploit-db.com/exploits/29178 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6195 · Security Note
• http://aria-security.com/forum/showthread.php?t=39 · Note
• http://securitytracker.com/id?1017281 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30513 · Note
• http://securityfocus.com/bid/21282 · Note
• http://securityfocus.com/archive/1/452567/100/0/threaded · Note