CVE-2006-6147 - Multiple SQL injection vulnerabilities in JiRos Links Manager allow remote attackers to execute arbi

CVE-2006-6147

Summary

Multiple SQL injection vulnerabilities in JiRos Links Manager allow remote attackers to execute arbitrary SQL commands via the (1) LinkID parameter to openlink.asp or the (2) CategoryID parameter to viewlinks.asp.

References

http://secunia.com/advisories/23063
http://securitytracker.com/id?1017280
http://www.frsirt.com/english/reference-2006-4664-1.php
http://www.securityfocus.com/archive/1/452265/100/0/threaded
http://www.securityfocus.com/bid/21226
http://www.vupen.com/english/advisories/2006/4664
https://exchange.xforce.ibmcloud.com/vulnerabilities/30462

Vulnerable Configurations

cpe:2.3:a:jiros:links_manager:1.0:*:*:*:*:*:*:*
cpe:2.3:a:jiros:links_manager:1.0:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 17-10-2018 - 21:46)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	21226
bugtraq	20061121 JiRos Links Manager[injection sql & xss permanent]
misc	http://www.frsirt.com/english/reference-2006-4664-1.php
sectrack	1017280
secunia	23063
vupen	ADV-2006-4664
xf	jiroslinkmanager-openlink-sql-injection(30462)

Last major update

17-10-2018 - 21:46

Published

28-11-2006 - 23:28

Last modified

17-10-2018 - 21:46