CVE-2006-5629
Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands via the ForumID parameter in (1) DisableForum.asp and (2) enableForum.asp.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.03%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands via the ForumID parameter in (1) DisableForum.asp and (2) enableForum.asp. NOTE: it was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 3.03% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- hosting controller/hosting controller
- Source
- cve@mitre.org
References
- http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html
- http://secunia.com/advisories/22607Vendor Advisory
- http://secunia.com/advisories/28973Vendor Advisory
- http://securitytracker.com/id?1017103Exploit, Patch
- http://www.kapda.ir/advisory-442.htmlExploit, Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/485028/100/0/threaded
- http://www.securityfocus.com/bid/20661Exploit, Patch
- http://www.securityfocus.com/bid/26862
- http://www.vupen.com/english/advisories/2006/4296Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39036
- https://www.exploit-db.com/exploits/4730
- http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html
- http://secunia.com/advisories/22607Vendor Advisory
- http://secunia.com/advisories/28973Vendor Advisory
- http://securitytracker.com/id?1017103Exploit, Patch
- http://www.kapda.ir/advisory-442.htmlExploit, Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/485028/100/0/threaded
- http://www.securityfocus.com/bid/20661Exploit, Patch
- http://www.securityfocus.com/bid/26862
- http://www.vupen.com/english/advisories/2006/4296Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39036
- https://www.exploit-db.com/exploits/4730
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.