CVE-2006-2508 - SQL injection vulnerability in tr1.php in YourFreeWorld.com Stylish Text Ads Script allows remote at

CVE-2006-2508

Summary

SQL injection vulnerability in tr1.php in YourFreeWorld.com Stylish Text Ads Script allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly involving an attack vector using advertise.php.

References

http://secunia.com/advisories/20213
http://securityreason.com/securityalert/931
http://www.osvdb.org/25691
http://www.osvdb.org/25692
http://www.securityfocus.com/archive/1/434527/100/0/threaded
http://www.securityfocus.com/bid/18044
http://www.vupen.com/english/advisories/2006/1897
https://exchange.xforce.ibmcloud.com/vulnerabilities/26569
https://exchange.xforce.ibmcloud.com/vulnerabilities/26570

Vulnerable Configurations

cpe:2.3:a:yourfreeworld:stylish_text_ads_script:*:*:*:*:*:*:*:*
cpe:2.3:a:yourfreeworld:stylish_text_ads_script:*:*:*:*:*:*:*:*

CVSS

Base:	6.4 (as of 18-10-2018 - 16:40)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:P/A:P

refmap via4

bid	18044
bugtraq	20060519 Yourfreeworld Styleish Text Ads Script
osvdb	25691 25692
secunia	20213
sreason	931
vupen	ADV-2006-1897
xf	yourfreeworld-tr1-advertise-sql-injection(26569) yourfreeworld-tr1-advertise-xss(26570)

Last major update

18-10-2018 - 16:40

Published

22-05-2006 - 19:02

Last modified

18-10-2018 - 16:40