CVE-2006-0669
Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the (1) Forum and (2) pages parameter.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.16%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in archive.asp in GA's Forum Light allow remote attackers to execute arbitrary SQL commands via the (1) Forum and (2) pages parameter. NOTE: SecurityTracker says that the vendor has disputed this issue, saying that GA Forum Light does not use an SQL database. SecurityTracker's research indicates that the original problem could be due to a vbscript parsing error based on invalid arguments
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.16% probability · 65th percentile
- CISA KEV
- Not listed
- Affected
- gasoft/gas forum light
- Source
- cve@mitre.org
References
- http://securitytracker.com/id?1015600Exploit
- http://www.attrition.org/pipermail/vim/2006-February/000561.html
- http://www.osvdb.org/23509
- http://www.securityfocus.com/bid/16563Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24616
- http://securitytracker.com/id?1015600Exploit
- http://www.attrition.org/pipermail/vim/2006-February/000561.html
- http://www.osvdb.org/23509
- http://www.securityfocus.com/bid/16563Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24616
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.