PT-2006-6970 · Unknown · Online-Bookmarks

Published 2006-12-07 · Updated 2017-07-29 · CVE-2006-6358

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions online-bookmarks version 0.6.12

Description A SQL injection issue exists in the login function, allowing remote attackers to execute arbitrary SQL commands. This can be achieved via the username and possibly the password parameter.

Recommendations For version 0.6.12, consider disabling the login function until a patch is available. Restrict access to the auth.inc file to minimize the risk of exploitation. Avoid using the username and password parameters in the affected login function until the issue is resolved.

Fix

Related Identifiers

CVE-2006-6358

Affected Products

Online-Bookmarks

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-6358 · Security Note
• http://secunia.com/advisories/23169 · Vendor Advisory
• http://securityfocus.com/bid/21422 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30696 · Note
• http://marc.info/?l=bugtraq&m=116525508018486&w=2 · Note
• http://vigilon.com/resources/120406.html · Note
• http://vupen.com/english/advisories/2006/4849 · Note