CVE-2006-0729

SQL injection vulnerability in functions.php in Teca Diary PE 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) yy, (2) mm, and (3) dd parameters.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.evuln.com/vulns/75/summary.html	Vendor Advisory
http://secunia.com/advisories/18876
http://securitytracker.com/id?1015674
http://www.securityfocus.com/bid/16686
http://securityreason.com/securityalert/477
http://www.vupen.com/english/advisories/2006/0615
https://exchange.xforce.ibmcloud.com/vulnerabilities/24643
http://www.securityfocus.com/archive/1/425892/30/6800/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:teca_scripts:teca_diary:personal_1.0:*:*:*:*:*:*:*

Information

Published : 2006-02-16 11:02

Updated : 2018-10-19 15:45

NVD link : CVE-2006-0729

Mitre link : CVE-2006-0729

JSON object : View

Products Affected

teca_scripts

teca_diary

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.evuln.com/vulns/75/summary.html", "name": "http://www.evuln.com/vulns/75/summary.html", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/18876", "name": "18876", "tags": [], "refsource": "SECUNIA"}, {"url": "http://securitytracker.com/id?1015674", "name": "1015674", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/16686", "name": "16686", "tags": [], "refsource": "BID"}, {"url": "http://securityreason.com/securityalert/477", "name": "477", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/0615", "name": "ADV-2006-0615", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24643", "name": "tecadiary-functions-sql-injection(24643)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/425892/30/6800/threaded", "name": "20060223 [eVuln] Teca Diary PE SQL Injection Vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SQL injection vulnerability in functions.php in Teca Diary PE 1.0 allows remote attackers to execute arbitrary SQL commands via the (1) yy, (2) mm, and (3) dd parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-0729", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-02-16T11:02Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:teca_scripts:teca_diary:personal_1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:45Z"}