VulnerabilityModified
CVE-2006-3184
Direct static code injection vulnerability in ASP Stats Generator before 2.1.2 allows remote authenticated attackers to execute arbitrary ASP code via the strAsgSknPageBgColour parameter to settings_skin.asp, which is stored in inc_skin_file.asp.
MEDIUM 4.0EPSS 2.29%
Does this matter?
Lower severity and a low EPSS score (2.29%). Track it; it rarely justifies an emergency change on its own.
Description
Direct static code injection vulnerability in ASP Stats Generator before 2.1.2 allows remote authenticated attackers to execute arbitrary ASP code via the strAsgSknPageBgColour parameter to settings_skin.asp, which is stored in inc_skin_file.asp.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
- EPSS
- 2.29% probability · 82th percentile
- CISA KEV
- Not listed
- Affected
- asp stats generator/asp stats generator
- Source
- cve@mitre.org
References
- http://blog.asp-stats.com/index.php/2006/06/18/asp-stats-generator-v212/
- http://secunia.com/advisories/20721Vendor Advisory
- http://www.hamid.ir/security/aspstats.txt
- http://www.vupen.com/english/advisories/2006/2414
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27284
- https://www.exploit-db.com/exploits/1931
- http://blog.asp-stats.com/index.php/2006/06/18/asp-stats-generator-v212/
- http://secunia.com/advisories/20721Vendor Advisory
- http://www.hamid.ir/security/aspstats.txt
- http://www.vupen.com/english/advisories/2006/2414
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27284
- https://www.exploit-db.com/exploits/1931
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.