VulnerabilityModified
CVE-2006-3318
SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) email parameters.
MEDIUM 5.1EPSS 1.20%
Does this matter?
Lower severity and a low EPSS score (1.20%). Track it; it rarely justifies an emergency change on its own.
Description
SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) email parameters.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 1.20% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- spiffyjr/phpraid
- Source
- PSIRT-CNA@flexerasoftware.com
References
- http://secunia.com/advisories/20865Vendor Advisory
- http://secunia.com/secunia_research/2006-47/advisory/Vendor Advisory
- http://securityreason.com/securityalert/1173
- http://www.securityfocus.com/archive/1/438706/100/0/threaded
- http://www.vupen.com/english/advisories/2006/2593Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27459
- http://secunia.com/advisories/20865Vendor Advisory
- http://secunia.com/secunia_research/2006-47/advisory/Vendor Advisory
- http://securityreason.com/securityalert/1173
- http://www.securityfocus.com/archive/1/438706/100/0/threaded
- http://www.vupen.com/english/advisories/2006/2593Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27459
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.