CVE-2006-1811: SQL Injection

Published Apr 18, 2006

Updated

Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the (1) id, (2) forumid, or (3) threadid parameter to index.php; the (4) ICQ, (5) AIM, (6) MSN, (7) Google Talk, (8) Website Name, (9) Website Address, (10) Email Address, (11) Location, (12) Signature, and (13) Sub-Titles fields in the user profile; or (14) flexbbpassword field in a cookie.

Affected Software

1 affected component

FlexBB FlexBB=0.5.5_beta

Event History

Apr 18, 2006

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1811?

CVE-2006-1811 is classified as a high severity vulnerability due to the potential for arbitrary SQL command execution.

How do I fix CVE-2006-1811?

To fix CVE-2006-1811, update FlexBB to a non-vulnerable version or sanitize user inputs to prevent SQL injection.

What types of parameters are vulnerable in CVE-2006-1811?

CVE-2006-1811 affects parameters such as id, forumid, threadid, and various user fields including ICQ and Email Address.

Who is affected by CVE-2006-1811?

Users of FlexBB version 0.5.5 BETA are affected by CVE-2006-1811.

What can attackers achieve with CVE-2006-1811?

Attackers exploiting CVE-2006-1811 can execute arbitrary SQL commands on the database, potentially compromising sensitive data.