PT-2006-7443 · Wywo · While You Were Out (Wywo) Inout Board

Ajann · Published 2006-12-31 · Updated 2017-10-19 · CVE-2006-6846

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: While You Were Out (WYWO) InOut Board version 1.0

Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through multiple parameters and fields, including the num parameter in the "phonemessage.asp" endpoint, the catcode parameter in the "faqDsp.asp" endpoint, and the Username and Password fields in the "login.asp" endpoint.

Recommendations: For While You Were Out (WYWO) InOut Board version 1.0, consider restricting access to the vulnerable endpoints and fields until a patch is available. As a temporary workaround, avoid using the num parameter in "phonemessage.asp", the catcode parameter in "faqDsp.asp", and the Username and Password fields in "login.asp" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Related Identifiers

CVE-2006-6846

Affected Products

While You Were Out (Wywo) Inout Board

References · 5

• 🔥 http://securityfocus.com/bid/21803 · Exploit
• 🔥 https://exploit-db.com/exploits/3032 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-6846 · Security Note
• http://secunia.com/advisories/23571 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31128 · Note