CVE-2010-1706: SQL Injection

Published May 4, 2010

Updated

Multiple SQL injection vulnerabilities in login.php in 2daybiz Auction Script allow remote attackers to execute arbitrary SQL commands via (1) the login field (aka the username parameter), and possibly (2) the password field, to index.php. NOTE: some of these details are obtained from third party information.

Affected Software

1 affected component

2daybiz Auction Script

Event History

May 4, 2010

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·04:00 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1706?

CVE-2010-1706 has a medium severity rating due to the potential for remote code execution via SQL injection.

How do I fix CVE-2010-1706?

To fix CVE-2010-1706, validate and sanitize user inputs in the login field and implement prepared statements for database queries.

What type of vulnerability is CVE-2010-1706?

CVE-2010-1706 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL commands.

Which software is affected by CVE-2010-1706?

CVE-2010-1706 affects the 2daybiz Auction Script application.

What parts of the 2daybiz Auction Script are vulnerable in CVE-2010-1706?

CVE-2010-1706 specifically targets the login.php file, allowing exploitation through the login and possibly the password fields.