CVE-2006-4667: SQL Injection
Published Sep 9, 2006
·Updated
Multiple SQL injection vulnerabilities in RunCMS 1.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) uid parameter in (a) class/sessions.class.php, and the (2) timezoneoffset and (3) umode parameters in (b) class/xoopsuser.php.
Affected Software
1 affected component
Runcms RunCMS=1.4.1
Remediation
Patch Available
Event History
Sep 9, 2006
CVE Published
12:04 AM
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-4667?
CVE-2006-4667 has a medium severity rating due to its potential for SQL injection attacks.
2
How do I fix CVE-2006-4667?
To fix CVE-2006-4667, you should update RunCMS to the latest version to ensure vulnerabilities are patched.
3
What software is affected by CVE-2006-4667?
CVE-2006-4667 affects RunCMS version 1.4.1.
4
What types of attacks can be executed using CVE-2006-4667?
CVE-2006-4667 allows attackers to execute arbitrary SQL commands through multiple input parameters.
5
Are there any workarounds for CVE-2006-4667?
Temporary workarounds for CVE-2006-4667 include validating and sanitizing user input to prevent SQL injection.