{"id": "CVE-2006-3494", "bulletinFamily": "NVD", "title": "CVE-2006-3494", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the (1) cat_id parameter to (a) view_classifieds.php; (2) id parameter in (b) view_ad.php; (3) event_id parameter in (c) view_event.php, (d) delete_event.php, and (e) edit_event.php; and (4) group_id in (f) view_group.php.", "published": "2006-07-10T18:05:00", "modified": "2018-10-18T12:47:45", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3494", "reporter": "NVD", "references": ["http://www.securityfocus.com/archive/1/440144/100/100/threaded", "http://www.securityfocus.com/archive/1/438868/100/0/threaded", "http://securityreason.com/securityalert/1209", "https://exchange.xforce.ibmcloud.com/vulnerabilities/27514", "http://www.securityfocus.com/bid/18759", "http://www.vupen.com/english/advisories/2006/2645"], "cvelist": ["CVE-2006-3494"], "type": "cve", "lastseen": "2018-10-19T11:35:59", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:vastal_i-tech:buddy_zone:1.0.1"], "cvelist": ["CVE-2006-3494"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Multiple cross-site scripting (XSS) vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the (1) cat_id parameter to (a) view_classifieds.php; (2) id parameter in (b) view_ad.php; (3) event_id parameter in (c) view_event.php, (d) delete_event.php, and (e) edit_event.php; and (4) group_id in (f) view_group.php.", "edition": 1, "enchantments": {}, "hash": "e53d7942ec61516caf8c44fc62a1c1a1f6405a57598c6b630e4281c0b43f2f98", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "65511afc49ef5e5d9d7b78114669b243", "key": "cvelist"}, {"hash": "7f82b28b3774ea9b952e94285df75758", "key": "description"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "f069384f61067316f2cf3cae9572ec01", "key": "href"}, {"hash": "0077e9e7d0a154acd4322336686d1ec7", "key": "modified"}, {"hash": "7ffdcc8a259d618a96f6a5bcddeade80", "key": "title"}, {"hash": "d461553a7e37edf7c828f5fada92486f", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}, {"hash": "38ac0925a34f63d7f318aea90adb390b", "key": "published"}, {"hash": "e1e2db4ba2ccc0bcb521de500089044f", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3494", "id": "CVE-2006-3494", "lastseen": "2016-09-03T07:13:23", "modified": "2011-09-08T00:00:00", "objectVersion": "1.2", "published": "2006-07-10T18:05:00", "references": ["http://xforce.iss.net/xforce/xfdb/27514", "http://www.securityfocus.com/archive/1/archive/1/438868/100/0/threaded", "http://securityreason.com/securityalert/1209", "http://www.securityfocus.com/bid/18759", "http://www.vupen.com/english/advisories/2006/2645", "http://www.securityfocus.com/archive/1/archive/1/440144/100/100/threaded"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-3494", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T07:13:23"}, {"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:vastal_i-tech:buddy_zone:1.0.1"], "cvelist": ["CVE-2006-3494"], "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Multiple cross-site scripting (XSS) vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the (1) cat_id parameter to (a) view_classifieds.php; (2) id parameter in (b) view_ad.php; (3) event_id parameter in (c) view_event.php, (d) delete_event.php, and (e) edit_event.php; and (4) group_id in (f) view_group.php.", "edition": 2, "enchantments": {"score": {"modified": "2017-07-20T10:49:24", "value": 4.3, "vector": "NONE"}}, "hash": "a47aafc4a9af69249fc65bed15e19b13ac2107898ad1156a7d411cc51a3e494a", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "65511afc49ef5e5d9d7b78114669b243", "key": "cvelist"}, {"hash": "7f82b28b3774ea9b952e94285df75758", "key": "description"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "f069384f61067316f2cf3cae9572ec01", "key": "href"}, {"hash": "7ffdcc8a259d618a96f6a5bcddeade80", "key": "title"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "ea1518ca8fb2c7031e54279c847e7213", "key": "modified"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "737e2591b537c46d1ca7ce6f0cea5cb9", "key": "cvss"}, {"hash": "38ac0925a34f63d7f318aea90adb390b", "key": "published"}, {"hash": "e1e2db4ba2ccc0bcb521de500089044f", "key": "cpe"}, {"hash": "aec655512b9322ce47fe533e22d6f7ed", "key": "references"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3494", "id": "CVE-2006-3494", "lastseen": "2017-07-20T10:49:24", "modified": "2017-07-19T21:32:20", "objectVersion": "1.3", "published": "2006-07-10T18:05:00", "references": ["http://www.securityfocus.com/archive/1/archive/1/438868/100/0/threaded", "http://securityreason.com/securityalert/1209", "https://exchange.xforce.ibmcloud.com/vulnerabilities/27514", "http://www.securityfocus.com/bid/18759", "http://www.vupen.com/english/advisories/2006/2645", "http://www.securityfocus.com/archive/1/archive/1/440144/100/100/threaded"], "reporter": "NVD", "scanner": [], "title": "CVE-2006-3494", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 2, "lastseen": "2017-07-20T10:49:24"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "e1e2db4ba2ccc0bcb521de500089044f"}, {"key": "cvelist", "hash": "65511afc49ef5e5d9d7b78114669b243"}, {"key": "cvss", "hash": "737e2591b537c46d1ca7ce6f0cea5cb9"}, {"key": "description", "hash": "7f82b28b3774ea9b952e94285df75758"}, {"key": "href", "hash": "f069384f61067316f2cf3cae9572ec01"}, {"key": "modified", "hash": "8f24ff067d11ebeaee69ce8b32dc0f6e"}, {"key": "published", "hash": "38ac0925a34f63d7f318aea90adb390b"}, {"key": "references", "hash": "cf93ce61490addcfcc377a2cf79163d6"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "7ffdcc8a259d618a96f6a5bcddeade80"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "e6222d70e667a0c3f90b2c33a52ac902c7b977ca66ff1f32aed2bbfac832701c", "viewCount": 0, "enchantments": {"score": {"value": 4.3, "vector": "NONE", "modified": "2018-10-19T11:35:59"}, "dependencies": {"references": [{"type": "osvdb", "idList": ["OSVDB:26990", "OSVDB:26993", "OSVDB:26982", "OSVDB:26979", "OSVDB:26983", "OSVDB:26980", "OSVDB:26985", "OSVDB:26984", "OSVDB:26981"]}], "modified": "2018-10-19T11:35:59"}, "vulnersScore": 4.3}, "objectVersion": "1.3", "cpe": ["cpe:/a:vastal_i-tech:buddy_zone:1.0.1"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": []}

{"osvdb": [{"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_group.php script not properly sanitizing user-supplied input to the 'group_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_group.php script not properly sanitizing user-supplied input to the 'group_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Manual Testing Notes\nhttp://[target]/view_group.php?group_id='\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26981](https://vulners.com/osvdb/OSVDB:26981)\n[Related OSVDB ID: 26982](https://vulners.com/osvdb/OSVDB:26982)\n[Related OSVDB ID: 26983](https://vulners.com/osvdb/OSVDB:26983)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26979](https://vulners.com/osvdb/OSVDB:26979)\n[Related OSVDB ID: 26980](https://vulners.com/osvdb/OSVDB:26980)\n[Related OSVDB ID: 26984](https://vulners.com/osvdb/OSVDB:26984)\n[Related OSVDB ID: 26987](https://vulners.com/osvdb/OSVDB:26987)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nISS X-Force ID: 27514\nISS X-Force ID: 27515\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26985", "id": "OSVDB:26985", "title": "Buddy Zone view_group.php group_id Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate form fields upon submission to the view_event.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nUpgrade to version 1.0.1 (2006-07-15) or higher, as it has been reported to fix this vulnerability. Note that this flaw was fixed in the July 15, 2006 release without a change in version number. An upgrade is required as there are no known workarounds.\n## Short Description\nBuddy Zone contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate form fields upon submission to the view_event.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26991](https://vulners.com/osvdb/OSVDB:26991)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26988](https://vulners.com/osvdb/OSVDB:26988)\n[Related OSVDB ID: 26989](https://vulners.com/osvdb/OSVDB:26989)\n[Related OSVDB ID: 26993](https://vulners.com/osvdb/OSVDB:26993)\n[Related OSVDB ID: 26979](https://vulners.com/osvdb/OSVDB:26979)\n[Related OSVDB ID: 26992](https://vulners.com/osvdb/OSVDB:26992)\n[Related OSVDB ID: 26987](https://vulners.com/osvdb/OSVDB:26987)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0245.html\nISS X-Force ID: 27512\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\nBugtraq ID: 18759\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26990", "id": "OSVDB:26990", "title": "Buddy Zone view_event.php XSS", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate form fields upon submission to the view_group.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nUpgrade to version 1.0.1 (2006-07-15) or higher, as it has been reported to fix this vulnerability. Note that this flaw was fixed in the July 15, 2006 release without a change in version number. An upgrade is required as there are no known workarounds.\n## Short Description\nBuddy Zone contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate form fields upon submission to the view_group.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26990](https://vulners.com/osvdb/OSVDB:26990)\n[Related OSVDB ID: 26991](https://vulners.com/osvdb/OSVDB:26991)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26988](https://vulners.com/osvdb/OSVDB:26988)\n[Related OSVDB ID: 26989](https://vulners.com/osvdb/OSVDB:26989)\n[Related OSVDB ID: 26979](https://vulners.com/osvdb/OSVDB:26979)\n[Related OSVDB ID: 26992](https://vulners.com/osvdb/OSVDB:26992)\n[Related OSVDB ID: 26987](https://vulners.com/osvdb/OSVDB:26987)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0245.html\nISS X-Force ID: 27512\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\nBugtraq ID: 18759\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26993", "id": "OSVDB:26993", "title": "Buddy Zone view_group.php XSS", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_sub_forum.php script not properly sanitizing user-supplied input to the 'main_cat' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_sub_forum.php script not properly sanitizing user-supplied input to the 'main_cat' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Manual Testing Notes\nhttp://[target]/view_sub_forum.php?main_cat='\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26981](https://vulners.com/osvdb/OSVDB:26981)\n[Related OSVDB ID: 26982](https://vulners.com/osvdb/OSVDB:26982)\n[Related OSVDB ID: 26983](https://vulners.com/osvdb/OSVDB:26983)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26985](https://vulners.com/osvdb/OSVDB:26985)\n[Related OSVDB ID: 26980](https://vulners.com/osvdb/OSVDB:26980)\n[Related OSVDB ID: 26984](https://vulners.com/osvdb/OSVDB:26984)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nISS X-Force ID: 27514\nISS X-Force ID: 27515\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26979", "id": "OSVDB:26979", "title": "Buddy Zone view_sub_forum.php main_cat Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_classifieds.php script not properly sanitizing user-supplied input to the 'cat_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_classifieds.php script not properly sanitizing user-supplied input to the 'cat_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Manual Testing Notes\nhttp://[target]/view_classifieds.php?cat_id=8'\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26981](https://vulners.com/osvdb/OSVDB:26981)\n[Related OSVDB ID: 26982](https://vulners.com/osvdb/OSVDB:26982)\n[Related OSVDB ID: 26983](https://vulners.com/osvdb/OSVDB:26983)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26979](https://vulners.com/osvdb/OSVDB:26979)\n[Related OSVDB ID: 26985](https://vulners.com/osvdb/OSVDB:26985)\n[Related OSVDB ID: 26984](https://vulners.com/osvdb/OSVDB:26984)\n[Related OSVDB ID: 26987](https://vulners.com/osvdb/OSVDB:26987)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nISS X-Force ID: 27514\nISS X-Force ID: 27515\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26980", "id": "OSVDB:26980", "title": "Buddy Zone view_classifieds.php cat_id Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the delete_event.php script not properly sanitizing user-supplied input to the 'event_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the delete_event.php script not properly sanitizing user-supplied input to the 'event_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Manual Testing Notes\nhttp://[target]/delete_event.php?event_id='\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26981](https://vulners.com/osvdb/OSVDB:26981)\n[Related OSVDB ID: 26982](https://vulners.com/osvdb/OSVDB:26982)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26979](https://vulners.com/osvdb/OSVDB:26979)\n[Related OSVDB ID: 26985](https://vulners.com/osvdb/OSVDB:26985)\n[Related OSVDB ID: 26980](https://vulners.com/osvdb/OSVDB:26980)\n[Related OSVDB ID: 26984](https://vulners.com/osvdb/OSVDB:26984)\n[Related OSVDB ID: 26987](https://vulners.com/osvdb/OSVDB:26987)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nISS X-Force ID: 27514\nISS X-Force ID: 27515\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26983", "id": "OSVDB:26983", "title": "Buddy Zone delete_event.php event_id Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_event.php script not properly sanitizing user-supplied input to the 'event_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_event.php script not properly sanitizing user-supplied input to the 'event_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Manual Testing Notes\nhttp://[target]/view_event.php?event_id=8'\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26981](https://vulners.com/osvdb/OSVDB:26981)\n[Related OSVDB ID: 26983](https://vulners.com/osvdb/OSVDB:26983)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26979](https://vulners.com/osvdb/OSVDB:26979)\n[Related OSVDB ID: 26985](https://vulners.com/osvdb/OSVDB:26985)\n[Related OSVDB ID: 26980](https://vulners.com/osvdb/OSVDB:26980)\n[Related OSVDB ID: 26984](https://vulners.com/osvdb/OSVDB:26984)\n[Related OSVDB ID: 26987](https://vulners.com/osvdb/OSVDB:26987)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nISS X-Force ID: 27514\nISS X-Force ID: 27515\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26982", "id": "OSVDB:26982", "title": "Buddy Zone view_event.php event_id Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_ad.php script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the view_ad.php script not properly sanitizing user-supplied input to the 'id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Manual Testing Notes\nhttp://[target]/view_ad.php?id=4'\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26982](https://vulners.com/osvdb/OSVDB:26982)\n[Related OSVDB ID: 26983](https://vulners.com/osvdb/OSVDB:26983)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26979](https://vulners.com/osvdb/OSVDB:26979)\n[Related OSVDB ID: 26985](https://vulners.com/osvdb/OSVDB:26985)\n[Related OSVDB ID: 26980](https://vulners.com/osvdb/OSVDB:26980)\n[Related OSVDB ID: 26984](https://vulners.com/osvdb/OSVDB:26984)\n[Related OSVDB ID: 26987](https://vulners.com/osvdb/OSVDB:26987)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nISS X-Force ID: 27514\nISS X-Force ID: 27515\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26981", "id": "OSVDB:26981", "title": "Buddy Zone view_ad.php id Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-04-28T13:20:23", "bulletinFamily": "software", "description": "## Vulnerability Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the edit_event.php script not properly sanitizing user-supplied input to the 'event_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nBuddy Zone contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the edit_event.php script not properly sanitizing user-supplied input to the 'event_id' variable. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n\nAdditionally, if a failed query is performed, the program will disclose the softwares installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.\n## Manual Testing Notes\nhttp://[target]/edit_event.php?event_id='\n## References:\nVendor URL: http://www.vastal.com/buddy-zone-social-networking-script.html\n[Secunia Advisory ID:20933](https://secuniaresearch.flexerasoftware.com/advisories/20933/)\n[Related OSVDB ID: 26981](https://vulners.com/osvdb/OSVDB:26981)\n[Related OSVDB ID: 26982](https://vulners.com/osvdb/OSVDB:26982)\n[Related OSVDB ID: 26983](https://vulners.com/osvdb/OSVDB:26983)\n[Related OSVDB ID: 26986](https://vulners.com/osvdb/OSVDB:26986)\n[Related OSVDB ID: 26979](https://vulners.com/osvdb/OSVDB:26979)\n[Related OSVDB ID: 26985](https://vulners.com/osvdb/OSVDB:26985)\n[Related OSVDB ID: 26980](https://vulners.com/osvdb/OSVDB:26980)\n[Related OSVDB ID: 26987](https://vulners.com/osvdb/OSVDB:26987)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-07/0011.html\nISS X-Force ID: 27514\nISS X-Force ID: 27515\nFrSIRT Advisory: ADV-2006-2645\n[CVE-2006-3494](https://vulners.com/cve/CVE-2006-3494)\n", "modified": "2006-06-30T09:33:59", "published": "2006-06-30T09:33:59", "href": "https://vulners.com/osvdb/OSVDB:26984", "id": "OSVDB:26984", "title": "Buddy Zone edit_event.php event_id Variable SQL Injection", "type": "osvdb", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}