CVE-2006-1828
SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable, as set by the php121un HTTP COOKIE parameter, which is used in multiple…
Does this matter?
Lower severity and a low EPSS score (2.02%). Track it; it rarely justifies an emergency change on its own.
Description
SQL injection vulnerability in php121language.php in PHP121 1.4 allows remote attackers to execute arbitrary SQL commands and execute arbitrary code via the sess_username variable, as set by the php121un HTTP COOKIE parameter, which is used in multiple files including php121login.php. NOTE: the code execution occurs because the SQL query results are used in an include statement.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 2.02% probability · 80th percentile
- CISA KEV
- Not listed
- Affected
- php121/php121 instant messenger
- Source
- cve@mitre.org
References
- http://retrogod.altervista.org/php121im_14_sql_xpl.html
- http://secunia.com/advisories/19643Vendor Advisory
- http://securitytracker.com/id?1015936
- http://www.securityfocus.com/bid/17509
- http://www.vupen.com/english/advisories/2006/1349
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25785
- https://www.exploit-db.com/exploits/1666
- http://retrogod.altervista.org/php121im_14_sql_xpl.html
- http://secunia.com/advisories/19643Vendor Advisory
- http://securitytracker.com/id?1015936
- http://www.securityfocus.com/bid/17509
- http://www.vupen.com/english/advisories/2006/1349
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25785
- https://www.exploit-db.com/exploits/1666
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.