CVE-2006-2136 - SQL injection vulnerability in news.php in AZNEWS allows remote attackers to execute arbitrary SQL c

CVE-2006-2136

Summary

SQL injection vulnerability in news.php in AZNEWS allows remote attackers to execute arbitrary SQL commands via the ID parameter. Other versions of this product may also be affected by this vulnerability.

References

http://evuln.com/vulns/126/
http://secunia.com/advisories/19888
http://securitytracker.com/id?1016036
http://www.securityfocus.com/bid/17761
http://www.vupen.com/english/advisories/2006/1579
https://exchange.xforce.ibmcloud.com/vulnerabilities/26136

Vulnerable Configurations

cpe:2.3:a:aznews:aznews:1.0:*:*:*:*:*:*:*
cpe:2.3:a:aznews:aznews:1.0:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 20-07-2017 - 01:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	17761
misc	http://evuln.com/vulns/126/
sectrack	1016036
secunia	19888
vupen	ADV-2006-1579
xf	aznews-news-sql-injection(26136)

Last major update

20-07-2017 - 01:31

Published

02-05-2006 - 10:02

Last modified

20-07-2017 - 01:31