{"id": "CVE-2006-1271", "bulletinFamily": "NVD", "title": "CVE-2006-1271", "description": "SQL injection vulnerability in index.php in OxyNews allows remote attackers to execute arbitrary SQL commands via the oxynews_comment_id parameter.", "published": "2006-03-18T21:02:00", "modified": "2017-07-19T21:30:27", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1271", "reporter": "NVD", "references": ["http://biyosecurity.be/bugs/oxynews.txt", "http://www.vupen.com/english/advisories/2006/0976", "https://exchange.xforce.ibmcloud.com/vulnerabilities/25301", "http://www.securityfocus.com/archive/1/archive/1/428057/100/0/threaded", "http://www.securityfocus.com/bid/17132"], "cvelist": ["CVE-2006-1271"], "type": "cve", "lastseen": "2017-07-20T10:49:10", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:oxynews:oxynews"], "cvelist": ["CVE-2006-1271"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "SQL injection vulnerability in index.php in OxyNews allows remote attackers to execute arbitrary SQL commands via the oxynews_comment_id parameter.", "edition": 1, "enchantments": {}, "hash": "caa29d6e653d2a7a9a816eac3c3c8434dae00bea81c221ec25691f1a7d519de6", "hashmap": [{"hash": "d99467b44fdf74d22c0c204de74f5113", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "35c06d68999e0492ef01851c3e384d88", "key": "description"}, {"hash": "f68be92c14fcf12ad078c5cff2dbea0f", "key": "references"}, {"hash": "ffd53543017a06002684b6ed0c03909b", "key": "title"}, {"hash": "b8301f1914cee1b3f08e3d926657c40a", "key": "modified"}, {"hash": "3b4e8a1b2d52d861ce775d68c63077b9", "key": "cvelist"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "b5c54d0d4b573bef0d30fa9bee96aee1", "key": "cpe"}, {"hash": "a89dfe2e35d9350c4bc9eb625d39aa9d", "key": "href"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1271", "id": "CVE-2006-1271", "lastseen": "2016-09-03T06:38:39", "modified": "2011-03-07T21:32:39", "objectVersion": "1.2", "published": "2006-03-18T21:02:00", "references": ["http://biyosecurity.be/bugs/oxynews.txt", "http://xforce.iss.net/xforce/xfdb/25301", "http://www.vupen.com/english/advisories/2006/0976", "http://www.securityfocus.com/archive/1/archive/1/428057/100/0/threaded", "http://www.securityfocus.com/bid/17132"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-1271", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T06:38:39"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "b5c54d0d4b573bef0d30fa9bee96aee1"}, {"key": "cvelist", "hash": "3b4e8a1b2d52d861ce775d68c63077b9"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "35c06d68999e0492ef01851c3e384d88"}, {"key": "href", "hash": "a89dfe2e35d9350c4bc9eb625d39aa9d"}, {"key": "modified", "hash": "f593ee3b2bb10a887f8711dcee53f1b3"}, {"key": "published", "hash": "d99467b44fdf74d22c0c204de74f5113"}, {"key": "references", "hash": "afa73b874bcd3fc855ba9e5e91acbb20"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "ffd53543017a06002684b6ed0c03909b"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "ff450264921533fb2ca0d677acee2f583a228c317cb452929078dbaf010a79c4", "viewCount": 0, "enchantments": {"vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:oxynews:oxynews"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"result": {"osvdb": [{"id": "OSVDB:23940", "type": "osvdb", "title": "OxyNews index.php oxynews_comment_id Variable SQL Injection", "description": "## Vulnerability Description\nOxyNews contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'oxynews_comment_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOxyNews contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'oxynews_comment_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Manual Testing Notes\nhttp://[target]/oxynews/index.php?oxynews_comment_id=[sql]\n## References:\nVendor URL: http://www.oxynews.net/\n[Secunia Advisory ID:19255](https://secuniaresearch.flexerasoftware.com/advisories/19255/)\nOther Advisory URL: http://biyosecurity.be/bugs/oxynews.txt\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-02/0892.html\nFrSIRT Advisory: ADV-2006-0976\n[CVE-2006-1271](https://vulners.com/cve/CVE-2006-1271)\nBugtraq ID: 17132\n", "published": "2006-03-16T08:17:36", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vulners.com/osvdb/OSVDB:23940", "cvelist": ["CVE-2006-1271"], "lastseen": "2017-04-28T13:20:20"}], "exploitdb": [{"id": "EDB-ID:27434", "type": "exploitdb", "title": "Oxynews Index.PHP SQL Injection Vulnerability", "description": "Oxynews Index.PHP SQL Injection Vulnerability. CVE-2006-1271. Webapps exploit for php platform", "published": "2006-03-16T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.exploit-db.com/exploits/27434/", "cvelist": ["CVE-2006-1271"], "lastseen": "2016-02-03T05:55:22"}]}}