Lucene search

[email protected]CVE-2006-1669

HistoryApr 07, 2006 - 10:04 a.m.

CVE-2006-1669

2006-04-0710:04:00

[email protected]

web.nvd.nist.gov

cve

2006

1669

sql injection

phpheaven team

phpmychat

vulnerability

remote attackers

arbitrary sql commands

t parameter

nvd

8.3 High

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.005 Low

EPSS

Percentile

77.5%

JSON

SQL injection vulnerability in chat/messagesL.php3 in phpHeaven Team PHPMyChat 0.14.5 and earlier allows remote attackers to execute arbitrary SQL commands via the T parameter. NOTE: this issue can be leveraged to execute arbitrary shell commands since the username is later processed in an eval() call, but since the username originated from the SQL injection, it could be a resultant issue.

Affected configurations

NVD

Node

phpheavenphpmychatRange≤0.14.5

phpheavenphpmychatMatch0.14.4

CPENameOperatorVersion
phpheaven:phpmychatphpheaven phpmychatle0.14.5
phpheaven:phpmychatphpheaven phpmychateq0.14.4

CPE	Name	Operator	Version
phpheaven:phpmychat	phpheaven phpmychat	le	0.14.5
phpheaven:phpmychat	phpheaven phpmychat	eq	0.14.4

References

securitytracker.com/id?1015873

www.securityfocus.com/archive/1/430358/100/0/threaded

www.securityfocus.com/bid/17382

exchange.xforce.ibmcloud.com/vulnerabilities/25687

www.exploit-db.com/exploits/1646

8.3 High

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.005 Low

EPSS

Percentile

77.5%

JSON

Related for CVE-2006-1669

cvelist1 prion1 nvd1