ID |
CVE-2006-5086
|
Summary |
Blog Pixel Motion 2.1.1 allows remote attackers to change the username and password for the admin user via a direct request to insere_base.php with modified (1) login and (2) pass parameters. NOTE: this issue was claimed to be SQL injection by the original researcher, but it is not. |
References |
|
Vulnerable Configurations |
|
CVSS |
Base: | 6.4 (as of 17-10-2018 - 21:41) |
Impact: | |
Exploitability: | |
|
CWE |
NVD-CWE-Other |
CAPEC |
|
Access |
Vector | Complexity | Authentication |
NETWORK |
LOW |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
PARTIAL |
PARTIAL |
NONE |
|
cvss-vector
via4
|
AV:N/AC:L/Au:N/C:P/I:P/A:N
|
refmap
via4
|
bugtraq | 20060927 Blog Pixel Motion V2.1.1 PHP Code Execution / Create Admin Exploit | misc | http://acid-root.new.fr/poc/12060927.txt | secunia | 22163 | sreason | 1653 | xf | blog-pixel-motion-inserebase-security-bypass(29222) |
|
Last major update |
17-10-2018 - 21:41 |
Published |
29-09-2006 - 00:07 |
Last modified |
17-10-2018 - 21:41 |