CVE-2006-5797

Multiple SQL injection vulnerabilities in default.asp in Xenis.creator CMS allow remote attackers to execute arbitrary SQL commands via the (1) nav, (2) s, or (3) print parameters.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.majorsecurity.de/index_2.php?major_rls=major_rls31
http://www.securityfocus.com/bid/20908
http://securitytracker.com/id?1017162	Vendor Advisory
http://secunia.com/advisories/22716
http://www.vupen.com/english/advisories/2006/4470
http://marc.info/?l=bugtraq&m=116267021732120&w=2
http://marc.info/?l=bugtraq&m=116266150514762&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/30017

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:xenis:xenis.creator_cms:*:*:*:*:*:*:*:*

Information

Published : 2006-11-08 12:07

Updated : 2017-07-19 18:33

NVD link : CVE-2006-5797

Mitre link : CVE-2006-5797

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

xenis

xenis.creator_cms

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.majorsecurity.de/index_2.php?major_rls=major_rls31", "name": "http://www.majorsecurity.de/index_2.php?major_rls=major_rls31", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/20908", "name": "20908", "tags": [], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1017162", "name": "1017162", "tags": ["Vendor Advisory"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/22716", "name": "22716", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2006/4470", "name": "ADV-2006-4470", "tags": [], "refsource": "VUPEN"}, {"url": "http://marc.info/?l=bugtraq&m=116267021732120&w=2", "name": "20061104 Re: MajorSecurity Advisory #31]Xenis.creator CMS - Multiple Cross", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://marc.info/?l=bugtraq&m=116266150514762&w=2", "name": "20061104 Xenis.creator CMS - Multiple Cross", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30017", "name": "xeniscreatorcms-default-sql-injection(30017)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in default.asp in Xenis.creator CMS allow remote attackers to execute arbitrary SQL commands via the (1) nav, (2) s, or (3) print parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-5797", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-11-08T20:07Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:xenis:xenis.creator_cms:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-20T01:33Z"}