7.5

CVE-2006-3135

Exploit
Multiple SQL injection vulnerabilities in CMS Mundo 1.0 build 008, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter in the (a) news module, (2) searchstring parameter in (b) the search module, (3) id parameter in (c) the webshop module, (4) username parameter in (d) index.php, and (5) Name, (6) Address, (7) Zip, (8) City, (9) Country, and (10) Email fields during (e) a user profile update.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hotwebscripts ≫ Cms Mundo Version1.0_build_008
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.86% 0.765
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://secunia.com/advisories/20589
Vendor Advisory
Exploit
http://secunia.com/secunia_research/2006-52/advisory/
Vendor Advisory
http://securityreason.com/securityalert/1236
http://www.osvdb.org/27139
http://www.osvdb.org/27140
http://www.osvdb.org/27141
http://www.osvdb.org/27142
http://www.osvdb.org/27143
http://www.vupen.com/english/advisories/2006/2783
https://exchange.xforce.ibmcloud.com/vulnerabilities/27712