CVE-2006-6337

Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL commands via the (1) kullanici or (2) parola parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/23291	Vendor Advisory
http://www.securityfocus.com/archive/1/453234/100/0/threaded
http://www.securityfocus.com/archive/1/454589/100/0/threaded
http://www.securityfocus.com/bid/21398	Exploit
http://www.securityfocus.com/bid/21627
http://www.vupen.com/english/advisories/2006/4825	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30919

Configurations

Configuration 1 (hide)

cpe:2.3:a:aspindir:aspee_ziyaretci_defteri:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-12-07 01:28

Updated : 2024-02-28 11:01

NVD link : CVE-2006-6337

Mitre link : CVE-2006-6337

CVE.ORG link : CVE-2006-6337

JSON object : View

Products Affected

aspindir

aspee_ziyaretci_defteri

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2006-6337", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-12-07T01:28:00.000", "references": [{"url": "http://secunia.com/advisories/23291", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/453234/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/454589/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21398", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21627", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4825", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30919", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL commands via the (1) kullanici or (2) parola parameter."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en giris.asp de Aspee y Dogantepe Ziyaretci Defteri permiten a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n mediante los par\u00e1metros (1) kullanici y (2) parola."}], "lastModified": "2018-10-17T21:47:46.800", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:aspindir:aspee_ziyaretci_defteri:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17964A5E-869A-4A55-803F-9805EF323FDD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}