7.5

CVE-2006-5872

login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dws Systems Inc. ≫ Sql-ledger Version2.6.27
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.7% 0.742
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/23375
Vendor Advisory
http://secunia.com/advisories/23419
Vendor Advisory
http://securitytracker.com/id?1017391
http://www.debian.org/security/2006/dsa-1239
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/458300/100/0/threaded
http://www.securityfocus.com/bid/21634
http://www.vupen.com/english/advisories/2006/5043
Vendor Advisory
http://www.vupen.com/english/advisories/2007/0407
Vendor Advisory