CVE-2006-6337

Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL commands via the (1) kullanici or (2) parola parameter.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/21398	Exploit
http://secunia.com/advisories/23291	Vendor Advisory
http://www.securityfocus.com/bid/21627
http://www.vupen.com/english/advisories/2006/4825	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30919
http://www.securityfocus.com/archive/1/454589/100/0/threaded
http://www.securityfocus.com/archive/1/453234/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:aspindir:aspee_ziyaretci_defteri:*:*:*:*:*:*:*:*

Information

Published : 2006-12-06 17:28

Updated : 2018-10-17 14:47

NVD link : CVE-2006-6337

Mitre link : CVE-2006-6337

JSON object : View

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Advertisement

Products Affected

aspindir

aspee_ziyaretci_defteri

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/21398", "name": "21398", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/23291", "name": "23291", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/21627", "name": "21627", "tags": [], "refsource": "BID"}, {"url": "http://www.vupen.com/english/advisories/2006/4825", "name": "ADV-2006-4825", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30919", "name": "antepe-giris-sql-injection(30919)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/454589/100/0/threaded", "name": "20061216 Doğantepe Ziyaretçi Defteri (tr) Sql Injection Vuln.", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/453234/100/0/threaded", "name": "20061201 Aspee Ziyaret&ccedil;i Defteri (tr) Sql injection Vuln.", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL commands via the (1) kullanici or (2) parola parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-89"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-6337", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-12-07T01:28Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:aspindir:aspee_ziyaretci_defteri:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:47Z"}