CVE-2006-2763 - SQL injection vulnerability in Pre News Manager 1.0 allows remote attackers to execute arbitrary SQL

CVE-2006-2763

Summary

SQL injection vulnerability in Pre News Manager 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to (a) index.php, and the (2) nid parameter to (b) news_detail.php, (c) email_story.php, (d) thankyou.php, (e) printable_view.php, (f) tella_friend.php, and (g) send_comments.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. It is possible that this is primary to CVE-2006-2678.

References

Vulnerable Configurations

cpe:2.3:a:pre_projects:pre_news_manager:1.0:*:*:*:*:*:*:*
cpe:2.3:a:pre_projects:pre_news_manager:1.0:*:*:*:*:*:*:*

CVSS

Base:	6.4 (as of 18-10-2018 - 16:41)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:N

refmap via4

bugtraq	20080615 [ECHO_ADV_97$2008] Pre News Manager <= 1.0 (index.php id) Sql Injection Vulnerability 20081009 News Manager Remote SQL Injection Vulnerability 20081009 Re: News Manager Remote SQL Injection Vulnerability
exploit-db	5803
osvdb	26073 26074 26075 26076 26077 26078 26079
secunia	20284
vupen	ADV-2006-1990
xf	prenewsmanager-index-sql-injection(43070) prenewsmanager-newsdetail-sql-injection(34035)

Last major update

18-10-2018 - 16:41

Published

02-06-2006 - 01:02

Last modified

18-10-2018 - 16:41