CVE-2006-3577: SQL Injection
Published Jul 13, 2006
·Updated
SQL injection vulnerability in index.php in LifeType 1.0.5 allows remote attackers to execute arbitrary SQL commands via the Date parameter in a Default op.
Affected Software
1 affected component
Lifetype LifeType=1.0.5
Remediation
Patch Available
Event History
Jul 13, 2006
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The issue can be exploited remotely without authentication. An attacker can send a crafted Date parameter to index.php when using the Default operation.
2
What is the potential impact if exploitation succeeds?
Successful exploitation allows execution of arbitrary SQL commands. This can affect the confidentiality, integrity, and availability of the application's data.
3
Is a fix available?
Yes. A patch is available; apply the vendor-provided patch to remediate the SQL injection vulnerability.