Vulnerability CVE-2006-1278
Published: 2006-03-19   Modified: 2012-02-12

Description:
SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
@1 File Store Multiple XSS and SQL Injection Vulnerabilities
alex evuln com
24.03.2006

Type:

CWE-89

 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Upoint -> @1 file store 

 References:
http://evuln.com/vulns/95/summary.html
http://securityreason.com/securityalert/619
http://securitytracker.com/id?1015826
http://www.attrition.org/pipermail/vim/2009-August/002246.html
http://www.securityfocus.com/archive/1/428659/100/0/threaded
http://www.securityfocus.com/bid/17090
http://www.securityfocus.com/bid/30182
http://www.vupen.com/english/advisories/2006/0943
https://exchange.xforce.ibmcloud.com/vulnerabilities/25183
https://exchange.xforce.ibmcloud.com/vulnerabilities/43718
https://exchange.xforce.ibmcloud.com/vulnerabilities/43724
https://www.exploit-db.com/exploits/6040
Copyright 2024, cxsecurity.com

 

Back to Top