CVE-2006-1920 - SQL injection vulnerability in index.php in PMTool 1.2.2 allows remote attackers to execute arbitrar

CVE-2006-1920

Summary

SQL injection vulnerability in index.php in PMTool 1.2.2 allows remote attackers to execute arbitrary SQL commands via the order parameter in the include files (1) user.inc.php, (2) customer.inc.php, and (3) project.inc.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

References

http://secunia.com/advisories/19685
http://www.osvdb.org/24780
http://www.osvdb.org/24781
http://www.osvdb.org/24782
http://www.securityfocus.com/bid/17599
http://www.vupen.com/english/advisories/2006/1416
https://exchange.xforce.ibmcloud.com/vulnerabilities/25877

Vulnerable Configurations

cpe:2.3:a:pmtool:pmtool:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:pmtool:pmtool:1.2.2:*:*:*:*:*:*:*

CVSS

Base:	6.4 (as of 20-07-2017 - 01:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:N

refmap via4

bid	17599
osvdb	24780 24781 24782
secunia	19685
vupen	ADV-2006-1416
xf	pmtool-order-sql-injection(25877)

Last major update

20-07-2017 - 01:31

Published

20-04-2006 - 18:06

Last modified

20-07-2017 - 01:31