vulnwire
7.5high

CVE-2006-6478in critical feed3 exploits

Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id param…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
10.5%
percentile 96%
Public exploits
3
Exploit-DB

Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) email.php, the (2) no parameter in (b) voirannonce.php, the (3) idmembre parameter in (c) admin/admin_membre/fiche_membre.php, and the (4) idannonce parameter in (d) admin/admin_annonce/okvalannonce.php and (e) admin/admin_annonce/changeannonce.php.

Exploit prediction (EPSS)

10.53% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

  • EDB-29253 AnnonceScriptHP 2.0 - 'voirannonce.php?no' SQL Injection · webapps · 2006-12-09
  • EDB-29252 AnnonceScriptHP 2.0 - 'email.php?id' SQL Injection · webapps · 2006-12-09
  • EDB-29246 AnnonceScriptHP 2.0 - '/admin/admin_membre/fiche_membre.php?idmembre' SQL Injection · webapps · 2006-12-09

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • securityfocus.com /archive/1/453966/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/21514 · vdb-entry, x_refsource_BID, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/30803 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/23318 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • vupen.com /english/advisories/2006/4940 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityreason.com /securityalert/2019 · third-party-advisory, x_refsource_SREASON, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.