CVE-2006-5829 - CVSS, EPSS & CISA Kev 상세 정보 | CVE Find

CVE 설명

Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) choosed_language parameter to (a) cp_dpage.php, (b) cp_news.php, (c) cp_forum_view.php, (d) cp_edit_user.php, (e) cp_newsletter.php, (f) cp_links.php, (g) cp_contact_us.php, (h) cp_login.php, and (i) cp_codice_fiscale.php in public/code/; (2) news_category parameter to public/code/cp_news.php; (3) nlmsg_nlcatid parameter to public/code/cp_newsletter.php; (4) links_category parameter to public/code/cp_links.php; (5) product_category_id parameter to public/code/cp_show_ec_products.php; (6) order_field parameter to public/code/cp_show_ec_products.php; (7) firstrow parameter to public/code/cp_users_online.php; and (8) orderdir parameter to public/code/cp_links_search.php.

CVE 정보

관련 약점

CWE-ID	약점 이름	출처
CWE-89	Improper Neutralization of Special Elements used in an SQL Command The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

메트릭

메트릭	점수	심각도	CVSS 벡터	출처
V2	6.8		AV:N/AC:M/Au:N/C:P/I:P/A:P	nvd@nist.gov

EPSS

EPSS는 취약점이 악용될 가능성을 예측하는 점수 모델입니다.

EPSS 점수

EPSS 모델은 0과 1(0~100%) 사이의 확률 점수를 생성합니다. 점수가 높을수록 취약점이 악용될 가능성이 높습니다.

EPSS 백분위수

백분위수는 EPSS 점수에 따라 CVE의 순위를 매기는 데 사용됩니다. 예를 들어 EPSS 점수 기준 95번째 백분위수의 CVE는 다른 CVE의 95%보다 악용될 가능성이 높습니다.

EPSS First.org

익스플로잇 정보

Exploit Database EDB-ID : 28933

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28929

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28923

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28926

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28925

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28928

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28934

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28931

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28924

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28927

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28930

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

Exploit Database EDB-ID : 28932

게시일 : 2006-11-05 23h00 +00:00
저자 : laurent gaffie
EDB 검증됨 : Yes

언급된 제품

구성 0

Aiocp>>Aiocp >> Version 까지 (포함) 1.3.007

Aiocp>>Aiocp >> Version 1.3.000

Aiocp>>Aiocp >> Version 1.3.001

Aiocp>>Aiocp >> Version 1.3.002

Aiocp>>Aiocp >> Version 1.3.003

Aiocp>>Aiocp >> Version 1.3.004

Aiocp>>Aiocp >> Version 1.3.005

Aiocp>>Aiocp >> Version 1.3.006

참고 자료

http://www.vupen.com/english/advisories/2006/4378
Tags : vdb-entry, x_refsource_VUPEN

http://www.securityfocus.com/archive/1/450701/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ

https://exchange.xforce.ibmcloud.com/vulnerabilities/30051
Tags : vdb-entry, x_refsource_XF

http://sourceforge.net/project/shownotes.php?release_id=478370
Tags : x_refsource_MISC

http://securityreason.com/securityalert/1839
Tags : third-party-advisory, x_refsource_SREASON

http://secunia.com/advisories/22719
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.securityfocus.com/bid/20931
Tags : vdb-entry, x_refsource_BID