PT-2006-6903 · Expinion.Net · Inews Publisher

Security Curmudgeon + 1 · Published 2006-12-04 · Updated 2018-10-17 · CVE-2006-6274

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Expinion.net iNews (iNP) Publisher versions 2.5 and earlier

Description The issue allows remote attackers to execute arbitrary SQL commands via the ex parameter in the articles.asp file. Initial reports incorrectly identified this as a cross-site scripting (XSS) issue, but it was later determined to be a SQL injection vulnerability. The vulnerability was initially reported for News Manager, but evidence suggests that the correct affected product is Publisher.

Recommendations For versions 2.5 and earlier, consider restricting access to the articles.asp file until a fix is available. As a temporary workaround, avoid using the ex parameter in the articles.asp file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2006-6274

Affected Products

Inews Publisher

References · 9

• 🔥 http://aria-security.com/forum/showthread.php?t=40 · Exploit
• 🔥 http://securityfocus.com/bid/21296 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6274 · Security Note
• http://secunia.com/advisories/23123 · Vendor Advisory
• http://securityreason.com/securityalert/1956 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30510 · Note
• http://attrition.org/pipermail/vim/2006-November/001147.html · Note
• http://vupen.com/english/advisories/2006/4707 · Note
• http://securityfocus.com/archive/1/452572/100/0/threaded · Note