CVE-2006-2887 - Multiple SQL injection vulnerabilities in myNewsletter 1.1.2 and earlier allow remote attackers to e

CVE-2006-2887

Summary

Multiple SQL injection vulnerabilities in myNewsletter 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the UserName parameter in (1) validatelogin.asp or (2) adminlogin.asp.

References

http://secunia.com/advisories/20423
http://securityreason.com/securityalert/1054
http://securitytracker.com/id?1016229
http://www.kapda.ir/advisory-340.html
http://www.osvdb.org/26127
http://www.osvdb.org/26274
http://www.securityfocus.com/archive/1/436018/100/0/threaded
http://www.securityfocus.com/bid/18287
http://www.vupen.com/english/advisories/2006/2149
https://exchange.xforce.ibmcloud.com/vulnerabilities/26947

Vulnerable Configurations

cpe:2.3:a:aspburst:mynewsletter:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:aspburst:mynewsletter:1.1.2:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 18-10-2018 - 16:43)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	18287
bugtraq	20060605 [KAPDA::#47] - myNewsletter 1.1.2 SQL_Injection
misc	http://www.kapda.ir/advisory-340.html
osvdb	26127 26274
sectrack	1016229
secunia	20423
sreason	1054
vupen	ADV-2006-2149
xf	mynewsletter-username-sql-injection(26947)

Last major update

18-10-2018 - 16:43

Published

07-06-2006 - 10:02

Last modified

18-10-2018 - 16:43