Lucene search

K
cve[email protected]CVE-2006-2065
HistoryApr 27, 2006 - 1:34 p.m.

CVE-2006-2065

2006-04-2713:34:00
web.nvd.nist.gov
21
cve-2006-2065
sql injection
phpsurveyor
vulnerability
security
nvd

8.5 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.5%

SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal sequences into the database, which are then processed by the thissurvey[‘language’] variable.

Affected configurations

NVD
Node
phpsurveyorphpsurveyorMatch0.96_beta
OR
phpsurveyorphpsurveyorMatch0.97_beta
OR
phpsurveyorphpsurveyorMatch0.98_beta
OR
phpsurveyorphpsurveyorMatch0.98_stable
OR
phpsurveyorphpsurveyorMatch0.99
OR
phpsurveyorphpsurveyorMatch0.991
OR
phpsurveyorphpsurveyorMatch0.992
OR
phpsurveyorphpsurveyorMatch0.993
OR
phpsurveyorphpsurveyorMatch0.995

8.5 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.5%

Related for CVE-2006-2065