CVE-2006-6828 - Multiple SQL injection vulnerabilities in Efkan Forum 1.0 and earlier allow remote attackers to exec

CVE-2006-6828

Summary

Multiple SQL injection vulnerabilities in Efkan Forum 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the grup parameter in admin.asp, or the id parameter in (2) default.asp or (3) admin.asp. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. The default.asp/grup vector is already covered by CVE-2006-6794.

References

http://www.vupen.com/english/advisories/2006/5150

Vulnerable Configurations

cpe:2.3:a:efkan_forum:efkan_forum:*:*:*:*:*:*:*:*
cpe:2.3:a:efkan_forum:efkan_forum:*:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 08-03-2011 - 02:47)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

vupen

ADV-2006-5150

Last major update

08-03-2011 - 02:47

Published

31-12-2006 - 05:00

Last modified

08-03-2011 - 02:47