CVE-2006-2544 - Multiple SQL injection vulnerabilities in Xtreme Topsites 1.1, with magic_quotes_gpc disabled, allow

CVE-2006-2544

Summary

Multiple SQL injection vulnerabilities in Xtreme Topsites 1.1, with magic_quotes_gpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) searchthis parameter in lostid.php and (2) id parameter in stats.php. NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.

References

http://secunia.com/advisories/20192
http://www.osvdb.org/25703
http://www.vupen.com/english/advisories/2006/1899

Vulnerable Configurations

cpe:2.3:a:xtreme_scripts:xtreme_topsites:1.1:*:*:*:*:*:*:*
cpe:2.3:a:xtreme_scripts:xtreme_topsites:1.1:*:*:*:*:*:*:*

CVSS

Base:	5.1 (as of 08-03-2011 - 02:36)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:P

refmap via4

osvdb	25703
secunia	20192
vupen	ADV-2006-1899

Last major update

08-03-2011 - 02:36

Published

23-05-2006 - 10:06

Last modified

08-03-2011 - 02:36