CVE-2006-5655: SQL Injection

Published Nov 3, 2006

Updated

SQL injection vulnerability in index.php in OpenDocMan 1.2p3 allows remote attackers to execute arbitrary SQL commands via the username parameter.

Affected Software

1 affected component

OpenDocMan OpenDocMan=1.2p3

Event History

Nov 3, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·12:07 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A remote attacker can exploit it without authentication. The vulnerable input is the username parameter handled by index.php.

What level of impact can exploitation have?

Successful exploitation allows execution of arbitrary SQL commands, with potential effects on confidentiality, integrity, and availability as reflected by the supplied CVSS vector.

How can I determine whether my deployment is affected?

Check whether the deployment is running OpenDocMan 1.2p3 and whether requests to index.php accept the username parameter. The provided data does not identify a fixed version or workaround.

CVE-2006-5655: SQL Injection

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of impact can exploitation have?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of impact can exploitation have?

How can I determine whether my deployment is affected?