CVE-2006-1766

Multiple SQL injection vulnerabilities in Papoo 2.1.5, and 3 beta1 and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) getlang and (2) reporeid parameter in (a) index.php, (3) menuid parameter in (b) plugin.php and (c) forumthread.php, and (4) msgid parameter in forumthread.php.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://pridels0.blogspot.com/2006/04/papoo-multiple-sql-vuln.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/25728
http://pridels0.blogspot.com/2006/04/papoo-multiple-sql-vuln.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/25728

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:papoo:papoo::::::::
	cpe:2.3:a:papoo:papoo:2.1.2:::::::*
	cpe:2.3:a:papoo:papoo:2.1.4:::::::*
	cpe:2.3:a:papoo:papoo:2.1.5:::::::*

History

21 Nov 2024, 00:09

Type	Values Removed	Values Added
References	~~() http://pridels0.blogspot.com/2006/04/papoo-multiple-sql-vuln.html -~~	() http://pridels0.blogspot.com/2006/04/papoo-multiple-sql-vuln.html -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/25728 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/25728 -

Information

Published : 2006-04-13 10:02

Updated : 2024-11-21 00:09

NVD link : CVE-2006-1766

Mitre link : CVE-2006-1766

CVE.ORG link : CVE-2006-1766

JSON object : View

Products Affected

papoo

papoo

CWE

NVD-CWE-Other

{"id": "CVE-2006-1766", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-04-13T10:02:00.000", "references": [{"url": "http://pridels0.blogspot.com/2006/04/papoo-multiple-sql-vuln.html", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25728", "source": "cve@mitre.org"}, {"url": "http://pridels0.blogspot.com/2006/04/papoo-multiple-sql-vuln.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25728", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in Papoo 2.1.5, and 3 beta1 and earlier, allow remote attackers to execute arbitrary SQL commands via the (1) getlang and (2) reporeid parameter in (a) index.php, (3) menuid parameter in (b) plugin.php and (c) forumthread.php, and (4) msgid parameter in forumthread.php."}], "lastModified": "2024-11-21T00:09:42.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:papoo:papoo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B41966A7-1E6D-4036-86F2-D3608D40393B", "versionEndIncluding": "3_beta1"}, {"criteria": "cpe:2.3:a:papoo:papoo:2.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D2F7F2A-D3A1-4A58-BFC1-3B89E1337C59"}, {"criteria": "cpe:2.3:a:papoo:papoo:2.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AF31C99-E038-472B-B6C2-FC421264DA98"}, {"criteria": "cpe:2.3:a:papoo:papoo:2.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56C91682-C8D9-47B1-A203-36B3334C2F66"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}