CVE-2006-1104: SQL Injection
Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USERAGENT, (3) HTTPREFERER, and (4) HTTPHOST HTTP header fields as used in the bookvistor function in includes/functions.php. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-1104?
The severity of CVE-2006-1104 is considered high due to its potential for remote SQL injection vulnerabilities.
How do I fix CVE-2006-1104?
To fix CVE-2006-1104, upgrade to Pixelpost version 1.5 or later, which addresses these vulnerabilities.
What are the affected versions of Pixelpost in CVE-2006-1104?
CVE-2006-1104 affects Pixelpost versions 1.5 beta 1 and earlier, specifically 1.4.3.
What kind of attacks can be executed using CVE-2006-1104?
CVE-2006-1104 allows attackers to execute arbitrary SQL commands that could compromise the database.
What components of Pixelpost are vulnerable in CVE-2006-1104?
CVE-2006-1104 vulnerabilities exist in the showimage parameter and specific HTTP header fields used in the book_visitor function.