CVE-2006-2748
SQL injection vulnerability in the do_mysql_query function in core.php for Open Searchable Image Catalogue (OSIC) before 0.7.0.1 allows remote attackers to inject arbitrary SQL commands via multiple vectors, as demonstrated by the (1) type parameter in…
Does this matter?
Lower severity and a low EPSS score (1.72%). Track it; it rarely justifies an emergency change on its own.
Description
SQL injection vulnerability in the do_mysql_query function in core.php for Open Searchable Image Catalogue (OSIC) before 0.7.0.1 allows remote attackers to inject arbitrary SQL commands via multiple vectors, as demonstrated by the (1) type parameter in adminfunctions.php and the (2) catalogue_id parameter in editcatalogue.php.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
- EPSS
- 1.72% probability · 76th percentile
- CISA KEV
- Not listed
- Affected
- open searchable image catalogue/open searchable image catalogue
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/20341Vendor Advisory
- http://securityreason.com/securityalert/1014
- http://securitytracker.com/id?1016178
- http://sourceforge.net/forum/forum.php?forum_id=576483
- http://svn.sourceforge.net/viewcvs.cgi/osic-win/branches/osic_0-7/osic/core.php?r1=477&r2=631
- http://www.seclab.tuwien.ac.at/advisories/TUVSA-0605-001.txtVendor Advisory
- http://www.securityfocus.com/archive/1/435380/100/0/threaded
- http://www.securityfocus.com/bid/18169
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26968
- http://secunia.com/advisories/20341Vendor Advisory
- http://securityreason.com/securityalert/1014
- http://securitytracker.com/id?1016178
- http://sourceforge.net/forum/forum.php?forum_id=576483
- http://svn.sourceforge.net/viewcvs.cgi/osic-win/branches/osic_0-7/osic/core.php?r1=477&r2=631
- http://www.seclab.tuwien.ac.at/advisories/TUVSA-0605-001.txtVendor Advisory
- http://www.securityfocus.com/archive/1/435380/100/0/threaded
- http://www.securityfocus.com/bid/18169
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26968
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.