CVE-2006-3221: SQL Injection
Published Jun 24, 2006
·Updated
SQL injection vulnerability in index.php in DataLife Engine 4.1 and earlier allows remote attackers to execute arbitrary SQL commands via double-encoded values in the user parameter in a userinfo subaction.
Affected Software
1 affected component
Softnews Media Group DataLife Engine<=4.1
Event History
Jun 24, 2006
CVE Published
10:06 AM
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
Which deployments are affected?
DataLife Engine 4.1 and earlier are affected. The issue is in index.php when handling a userinfo subaction.
2
What does an attacker need to exploit this issue?
The vulnerability is remotely exploitable with no authentication required. An attacker sends double-encoded values through the user parameter to inject SQL commands.
3
What is the potential impact?
Successful exploitation can allow execution of arbitrary SQL commands, affecting the confidentiality, integrity, and availability of the application’s data.