{"id": "CVE-2006-1639", "bulletinFamily": "NVD", "title": "CVE-2006-1639", "description": "SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.", "published": "2006-04-06T06:04:00", "modified": "2018-10-18T12:33:42", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1639", "reporter": "NVD", "references": ["http://www.securityfocus.com/archive/1/431186/100/0/threaded", "http://securitytracker.com/id?1015951", "http://www.securityfocus.com/bid/17381", "https://exchange.xforce.ibmcloud.com/vulnerabilities/25628", "http://www.vupen.com/english/advisories/2006/1238", "http://securityreason.com/securityalert/734", "http://evuln.com/vulns/119/summary.html"], "cvelist": ["CVE-2006-1639"], "type": "cve", "lastseen": "2018-10-19T11:35:58", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:wire_plastik_design:wpblog:0.4"], "cvelist": ["CVE-2006-1639"], "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.", "edition": 2, "enchantments": {"score": {"modified": "2017-07-20T10:49:12", "value": 7.5, "vector": "NONE"}}, "hash": "bfbbf6f4c190ee8d47c87c8e094877d7925afbab1d6b06ed6d79c46eade9fba8", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d0531a1d065d7454a18f49d1055d2596", "key": "published"}, {"hash": "c32f321f1136c44f24a6cd62da08a0ad", "key": "description"}, {"hash": "a3add18a477b55e7ab962a16c96ea486", "key": "modified"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "9cd1bac531d901173a29c6d85fabea2f", "key": "href"}, {"hash": "eab129bb824e3df7d0472b2875779b2d", "key": "cvelist"}, {"hash": "8b386a5558031126d061c44cf4d3c659", "key": "cpe"}, {"hash": "23d5799e9eac6c27d55a959056f0bd20", "key": "title"}, {"hash": "88e04999358e76acae57a21bcf224d40", "key": "cvss"}, {"hash": "5e85f20b69e7f7cbca32efb8bdd4ed7e", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1639", "id": "CVE-2006-1639", "lastseen": "2017-07-20T10:49:12", "modified": "2017-07-19T21:30:46", "objectVersion": "1.3", "published": "2006-04-06T06:04:00", "references": ["http://securitytracker.com/id?1015951", "http://www.securityfocus.com/bid/17381", "https://exchange.xforce.ibmcloud.com/vulnerabilities/25628", "http://www.securityfocus.com/archive/1/archive/1/431186/100/0/threaded", "http://www.vupen.com/english/advisories/2006/1238", "http://securityreason.com/securityalert/734", "http://evuln.com/vulns/119/summary.html"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-1639", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2017-07-20T10:49:12"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:wire_plastik_design:wpblog:0.4"], "cvelist": ["CVE-2006-1639"], "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "SQL injection vulnerability in index.php in wpBlog 0.4 allows remote attackers to execute arbitrary SQL commands via the postid parameter.", "edition": 1, "enchantments": {}, "hash": "e7b44a5964a8dd9a89dde9c0462a724205d12bc4a2c24bf213705518430e6bf4", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "d0531a1d065d7454a18f49d1055d2596", "key": "published"}, {"hash": "c32f321f1136c44f24a6cd62da08a0ad", "key": "description"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "9cd1bac531d901173a29c6d85fabea2f", "key": "href"}, {"hash": "eab129bb824e3df7d0472b2875779b2d", "key": "cvelist"}, {"hash": "d1076f35b79bbabf9f87cf0d35726dd1", "key": "modified"}, {"hash": "c9eaa848b8e4bda7dcc22d4d83e4a8a4", "key": "references"}, {"hash": "8b386a5558031126d061c44cf4d3c659", "key": "cpe"}, {"hash": "23d5799e9eac6c27d55a959056f0bd20", "key": "title"}, {"hash": "88e04999358e76acae57a21bcf224d40", "key": "cvss"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-1639", "id": "CVE-2006-1639", "lastseen": "2016-09-03T06:44:28", "modified": "2013-07-18T09:45:07", "objectVersion": "1.2", "published": "2006-04-06T06:04:00", "references": ["http://securitytracker.com/id?1015951", "http://www.securityfocus.com/bid/17381", "http://www.securityfocus.com/archive/1/archive/1/431186/100/0/threaded", "http://xforce.iss.net/xforce/xfdb/25628", "http://www.vupen.com/english/advisories/2006/1238", "http://securityreason.com/securityalert/734", "http://evuln.com/vulns/119/summary.html"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-1639", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T06:44:28"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "8b386a5558031126d061c44cf4d3c659"}, {"key": "cvelist", "hash": "eab129bb824e3df7d0472b2875779b2d"}, {"key": "cvss", "hash": "88e04999358e76acae57a21bcf224d40"}, {"key": "description", "hash": "c32f321f1136c44f24a6cd62da08a0ad"}, {"key": "href", "hash": "9cd1bac531d901173a29c6d85fabea2f"}, {"key": "modified", "hash": "6a08c52ef8b5f3a80ec54e4b5b6f034e"}, {"key": "published", "hash": "d0531a1d065d7454a18f49d1055d2596"}, {"key": "references", "hash": "c273618c6b4f5d76786a22cc641b52f5"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "23d5799e9eac6c27d55a959056f0bd20"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "49cd25d41322509d9fd2cc31beb7626f075aacf1c40faff9c6d70c36834ecc07", "viewCount": 0, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2018-10-19T11:35:58"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "cpe": ["cpe:/a:wire_plastik_design:wpblog:0.4"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"securityvulns": [{"lastseen": "2018-08-31T11:10:17", "references": [], "description": "New eVuln Advisory:\r\nWire Plastik wpBlog SQL Injection Vulnerability\r\nhttp://evuln.com/vulns/119/summary.html\r\n\r\n--------------------Summary----------------\r\neVuln ID: EV0119\r\nCVE: CVE-2006-1639\r\nSoftware: wpBlog\r\nSowtware's Web Site: http://www.wireplastik.com/\r\nVersions: 0.4\r\nCritical Level: Moderate\r\nType: SQL Injection\r\nClass: Remote\r\nStatus: Unpatched. No reply from developer(s)\r\nPoC/Exploit: Available\r\nSolution: Not Available\r\nDiscovered by: Aliaksandr Hartsuyeu (eVuln.com)\r\n\r\n-----------------Description---------------\r\nVulnerable script: index.php\r\n\r\nParameter postid is not properly sanitized before being used in SQL query. This can be used to make any SQL query by injecting arbitrary SQL code.\r\n\r\nCondition: magic_quotes_gpc = off\r\n\r\n\r\n--------------PoC/Exploit----------------------\r\nAvailable at: http://evuln.com/vulns/119/exploit.html\r\n\r\n--------------Solution---------------------\r\nNo Patch available.\r\n\r\n--------------Credit-----------------------\r\nDiscovered by: Aliaksandr Hartsuyeu (eVuln.com)\r\n\r\n\r\nRegards,\r\nAliaksandr Hartsuyeu\r\nhttp://evuln.com - Penetration Testing Services\r\n.\r\n", "edition": 1, "reporter": "Securityvulns", "published": "2006-04-18T00:00:00", "title": "[eVuln] Wire Plastik wpBlog SQL Injection Vulnerability", "type": "securityvulns", "enchantments": {"score": {"modified": "2018-08-31T11:10:17", "vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [], "cvelist": ["CVE-2006-1639"], "modified": "2006-04-18T00:00:00", "id": "SECURITYVULNS:DOC:12285", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:12285", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:21", "references": [], "edition": 1, "description": "## Vulnerability Description\nwpBlog contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'postid' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Technical Description\nThis vulnerability is only present when the magic_quotes_gpc PHP option is 'off'.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nwpBlog contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the index.php script not properly sanitizing user-supplied input to the 'postid' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## References:\nVendor URL: http://www.wireplastik.com/\nSecurity Tracker: 1015951\n[Secunia Advisory ID:19538](https://secuniaresearch.flexerasoftware.com/advisories/19538/)\nOther Advisory URL: http://evuln.com/vulns/119/summary.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-04/0349.html\nKeyword: EV0119\nISS X-Force ID: 25628\nFrSIRT Advisory: ADV-2006-1238\n[CVE-2006-1639](https://vulners.com/cve/CVE-2006-1639)\nBugtraq ID: 17381\n", "reporter": "Aliaksandr Hartsuyeu(alex@evuln.com)", "published": "2006-04-04T05:02:36", "type": "osvdb", "title": "wpBlog index.php postid Variable SQL Injection", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "wpBlog", "version": "0.4", "operator": "eq"}], "cvelist": ["CVE-2006-1639"], "modified": "2006-04-04T05:02:36", "href": "https://vulners.com/osvdb/OSVDB:24385", "id": "OSVDB:24385", "cvss": {"score": 5.1, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}