CVE-2006-2915

Multiple SQL injection vulnerabilities in DeluxeBB 1.06 allow remote attackers to execute arbitrary SQL commands via the (1) hideemail, (2) languagex, (3) xthetimeoffset, and (4) xthetimeformat parameters during account registration.

CVSS v2.0 5.1 MEDIUM

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/secunia_research/2006-44/advisory	Vendor Advisory
http://www.securityfocus.com/bid/18453
http://securitytracker.com/id?1016309
http://secunia.com/advisories/20152	Vendor Advisory
http://www.osvdb.org/26457
http://securityreason.com/securityalert/1134
http://www.vupen.com/english/advisories/2006/2347
https://exchange.xforce.ibmcloud.com/vulnerabilities/27091
http://www.securityfocus.com/archive/1/438597/100/0/threaded
http://www.securityfocus.com/archive/1/437228/100/100/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:a:deluxebb:deluxebb:1.06:*:*:*:*:*:*:*

Information

Published : 2006-06-23 20:06

Updated : 2018-10-18 16:43

NVD link : CVE-2006-2915

Mitre link : CVE-2006-2915

JSON object : View

Products Affected

deluxebb

deluxebb

CWE

NVD-CWE-Other

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/secunia_research/2006-44/advisory", "name": "http://secunia.com/secunia_research/2006-44/advisory", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/18453", "name": "18453", "tags": [], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1016309", "name": "1016309", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/20152", "name": "20152", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/26457", "name": "26457", "tags": [], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/1134", "name": "1134", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/2347", "name": "ADV-2006-2347", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27091", "name": "deluxebb-accountreg-sql-injection(27091)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/438597/100/0/threaded", "name": "20060628 Secunia Research: DeluxeBB SQL Injection and File InclusionVulnerabilities", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/archive/1/437228/100/100/threaded", "name": "20060614 Secunia Research: DeluxeBB SQL Injection and File InclusionVulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in DeluxeBB 1.06 allow remote attackers to execute arbitrary SQL commands via the (1) hideemail, (2) languagex, (3) xthetimeoffset, and (4) xthetimeformat parameters during account registration."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-2915", "ASSIGNER": "PSIRT-CNA@flexerasoftware.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2006-06-23T20:06Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:deluxebb:deluxebb:1.06:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-18T16:43Z"}