CVE-2006-6358
SQL injection vulnerability in the login function in auth.inc in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to execute arbitrary SQL commands via the (1) username and possibly the (2) password parameter.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SQL injection vulnerability in the login function in auth.inc in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to execute arbitrary SQL commands via the (1) username and possibly the (2) password parameter. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.31% probability · 69th percentile
- CISA KEV
- Not listed
- Affected
- stefan frech/online-bookmarks
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=116525508018486&w=2
- http://secunia.com/advisories/23169Vendor Advisory
- http://www.securityfocus.com/bid/21422
- http://www.vigilon.com/resources/120406.html
- http://www.vupen.com/english/advisories/2006/4849
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30696
- http://marc.info/?l=bugtraq&m=116525508018486&w=2
- http://secunia.com/advisories/23169Vendor Advisory
- http://www.securityfocus.com/bid/21422
- http://www.vigilon.com/resources/120406.html
- http://www.vupen.com/english/advisories/2006/4849
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30696
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.