CVE-2006-2857: SQL Injection
Published Jun 6, 2006
·Updated
SQL injection vulnerability in index.php in LifeType 1.0.4 allows remote attackers to execute arbitrary SQL commands via the articleId parameter in a ViewArticle action (viewarticleaction.class.php).
Affected Software
3 affected components
Lifetype LifeType=1.0.3
Lifetype LifeType=1.0.2
Lifetype LifeType=1.0.4
Remediation
Patch Available
Event History
Jun 6, 2006
CVE Published
08:06 PM
Jun 7, 2006
CVE Published
via MITRE·12:03 AM
Data Sourced
via MITRE·12:03 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
Remote attackers can exploit it over the network without authentication. Exploitation involves supplying a crafted articleId parameter when invoking the ViewArticle action.
2
What is the likely impact of successful exploitation?
An attacker can execute arbitrary SQL commands. The listed impact includes compromise of confidentiality, integrity, and availability.
3
Is a fix available?
Yes. A patch is available, and the referenced LifeType security upgrade announcement identifies LifeType 1.0.5 as a released security upgrade.