7.5high
CVE-2006-28351 exploit
SQL injection vulnerability in saphplesson 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) forumid parameter in a…
Published 20 y ago · modified 4 mo ago · JSON
CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 70%
Public exploits
1
Exploit-DB
Summary
SQL injection vulnerability in saphplesson 2.0 allows remote attackers to execute arbitrary SQL commands via the (1) forumid parameter in add.php and (2) lessid parameter in show.php.
Exploit prediction (EPSS)
1.28% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.
Exploits and detections
- EDB-28204 SaPHPLesson 2.0 - 'add.php' SQL Injection · webapps · 2006-07-11
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
- exchange.xforce.ibmcloud.com /vulnerabilities/26757 · vdb-entry, x_refsource_XF, x_transferred
- securityreason.com /securityalert/1047 · third-party-advisory, x_refsource_SREASON, x_transferred
- securityfocus.com /archive/1/472798/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/18117 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /bid/18934 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /archive/1/440120 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /archive/1/435202/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
Sources
- CVE List: CVE-2006-2835
- NVD: CVE-2006-2835
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.