Vulnerability CVE-2006-2748
Published: 2006-06-01   Modified: 2012-02-12

Description:
SQL injection vulnerability in the do_mysql_query function in core.php for Open Searchable Image Catalogue (OSIC) before 0.7.0.1 allows remote attackers to inject arbitrary SQL commands via multiple vectors, as demonstrated by the (1) type parameter in adminfunctions.php and the (2) catalogue_id parameter in editcatalogue.php.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Open Searchable Image Catalogue: XSS and SQL Injection Vulnerabilities
enji seclab tuwi...
03.06.2006

Type:

CWE-Other

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Open searchable image catalogue -> Open searchable image catalogue 

 References:
http://securityreason.com/securityalert/1014
http://securitytracker.com/id?1016178
http://sourceforge.net/forum/forum.php?forum_id=576483
http://svn.sourceforge.net/viewcvs.cgi/osic-win/branches/osic_0-7/osic/core.php?r1=477&r2=631
http://www.seclab.tuwien.ac.at/advisories/TUVSA-0605-001.txt
http://www.securityfocus.com/archive/1/435380/100/0/threaded
http://www.securityfocus.com/bid/18169
https://exchange.xforce.ibmcloud.com/vulnerabilities/26968
Copyright 2024, cxsecurity.com

 

Back to Top