CVE-2006-3515

SQL injection vulnerability in the loginADP function in ajaxp.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.kapda.ir/advisory-355.html	Vendor Advisory
http://www.securityfocus.com/bid/18897
http://secunia.com/advisories/20985
http://www.osvdb.org/27067
http://securityreason.com/securityalert/1206
http://www.vupen.com/english/advisories/2006/2714
http://www.securityfocus.com/archive/1/439614/100/0/threaded
http://www.securityfocus.com/archive/1/439521/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:myiosoft.com:ajaxportal:3.0:*:*:*:*:*:*:*

Information

Published : 2006-07-11 16:05

Updated : 2018-10-18 09:47

NVD link : CVE-2006-3515

Mitre link : CVE-2006-3515

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

myiosoft.com

ajaxportal

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.kapda.ir/advisory-355.html", "name": "http://www.kapda.ir/advisory-355.html", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/18897", "name": "18897", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/20985", "name": "20985", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/27067", "name": "27067", "tags": [], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/1206", "name": "1206", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/2714", "name": "ADV-2006-2714", "tags": [], "refsource": "VUPEN"}, {"url": "http://www.securityfocus.com/archive/1/439614/100/0/threaded", "name": "20060709 Re: [KAPDA::#46] - AjaxPortal Authentication Bypass", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/439521/100/0/threaded", "name": "20060708 [KAPDA::#46] - AjaxPortal Authentication Bypass", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SQL injection vulnerability in the loginADP function in ajaxp.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3515", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-07-11T23:05Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:myiosoft.com:ajaxportal:3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:47Z"}