CVE-2006-2835 - SQL injection vulnerability in saphplesson 2.0 allows remote attackers to execute arbitrary SQL comm

CVE-2006-2835

Summary

SQL injection vulnerability in saphplesson 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) forumid parameter in add.php and (2) lessid parameter in show.php.

References

http://securityreason.com/securityalert/1047
http://www.securityfocus.com/archive/1/435202/100/0/threaded
http://www.securityfocus.com/archive/1/440120
http://www.securityfocus.com/archive/1/472798/100/0/threaded
http://www.securityfocus.com/bid/18117
http://www.securityfocus.com/bid/18934
https://exchange.xforce.ibmcloud.com/vulnerabilities/26757

Vulnerable Configurations

cpe:2.3:a:arabless:saphplesson:2.0:*:*:*:*:*:*:*
cpe:2.3:a:arabless:saphplesson:2.0:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 18-10-2018 - 16:43)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	18117 18934
bugtraq	20060527 Critical sql injection in saphplesson 2.0 20060711 saphp "add.php" forumid Parameter SQL Injection 20070704 SQL Injection in SaphpLesson2.0 "show.php"
sreason	1047
xf	saphplesson-show-sql-injection(26757)

Last major update

18-10-2018 - 16:43

Published

06-06-2006 - 20:06

Last modified

18-10-2018 - 16:43