CVE-2006-1421: SQL Injection
Published Mar 28, 2006
·Updated
Multiple SQL injection vulnerabilities in akocomment.php in AkoComment 2.0 module for Mambo, with magicquotesgpc disabled, allow remote attackers to execute arbitrary SQL commands via the (1) acname or (2) contentid parameter.
Affected Software
1 affected component
Arthur Konze Webdesign Akocomment=2.0
Remediation
Patch Available
Event History
Mar 28, 2006
CVE Published
08:02 PM
Mar 29, 2006
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-1421?
CVE-2006-1421 is considered a critical vulnerability due to its potential for remote SQL injection.
2
How do I fix CVE-2006-1421?
To fix CVE-2006-1421, ensure that magic_quotes_gpc is enabled or update to a patched version of AkoComment that resolves the SQL injection issues.
3
Who is affected by CVE-2006-1421?
CVE-2006-1421 affects users of AkoComment 2.0 for Mambo without the magic_quotes_gpc setting enabled.
4
What are the attack vectors for CVE-2006-1421?
Attackers can exploit CVE-2006-1421 through the acname or contentid parameters in akocomment.php to execute arbitrary SQL commands.
5
When was CVE-2006-1421 disclosed?
CVE-2006-1421 was disclosed in April 2006.