CVE-2006-3221: SQL Injection

Q: Which deployments are affected?

DataLife Engine 4.1 and earlier are affected. The issue is in index.php when handling a userinfo subaction.

Q: What does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with no authentication required. An attacker sends double-encoded values through the user parameter to inject SQL commands.

Q: What is the potential impact?

Successful exploitation can allow execution of arbitrary SQL commands, affecting the confidentiality, integrity, and availability of the application’s data.

Published Jun 24, 2006

Updated

SQL injection vulnerability in index.php in DataLife Engine 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded values in the user parameter in a userinfo subaction.

Affected Software

1 affected component

Softnews Media Group DataLife Engine<=4.1

Event History

Jun 24, 2006

CVE Published

10:06 AM

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

Which deployments are affected?

DataLife Engine 4.1 and earlier are affected. The issue is in index.php when handling a userinfo subaction.

What does an attacker need to exploit this issue?

The vulnerability is remotely exploitable with no authentication required. An attacker sends double-encoded values through the user parameter to inject SQL commands.

What is the potential impact?

Successful exploitation can allow execution of arbitrary SQL commands, affecting the confidentiality, integrity, and availability of the application’s data.

CVE-2006-3221: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the potential impact?