{"enchantments": {"score": {"value": 6.5, "vector": "NONE", "modified": "2017-04-28T13:20:20", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-0919"]}], "modified": "2017-04-28T13:20:20", "rev": 2}, "vulnersScore": 6.5}, "bulletinFamily": "software", "affectedSoftware": [{"name": "Oi! Email Marketing System", "operator": "eq", "version": "3.0"}], "references": [], "href": "https://vulners.com/osvdb/OSVDB:23462", "id": "OSVDB:23462", "title": "Oi! Email Marketing System Login Username Field SQL Injection", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "lastseen": "2017-04-28T13:20:20", "edition": 1, "reporter": "Illuminatus(illuminatus85@gmail.com), h4cky0u(h4cky0u@gmail.com)", "description": "## Vulnerability Description\nOi! Email Marketing System contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'username' input field in the login screen. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## Solution Description\nCurrently, there are no known upgrades, patches, or workarounds available to correct this issue.\n## Short Description\nOi! Email Marketing System contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the 'index.php' script not properly sanitizing user-supplied input to the 'username' input field in the login screen. This may allow an attacker to inject or manipulate SQL queries in the backend database.\n## References:\nVendor URL: http://www.miro.com.au/\n[Secunia Advisory ID:18993](https://secuniaresearch.flexerasoftware.com/advisories/18993/)\nOther Advisory URL: http://www.h4cky0u.org/advisories/HYSA-2006-003-oi-email.txt\nMail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0591.html\nFrSIRT Advisory: ADV-2006-0718\n[CVE-2006-0919](https://vulners.com/cve/CVE-2006-0919)\n", "modified": "2006-02-23T06:02:36", "viewCount": 8, "published": "2006-02-23T06:02:36", "cvelist": ["CVE-2006-0919"]}

{"cve": [{"lastseen": "2020-10-03T11:48:13", "description": "SQL injection vulnerability in index.php (aka the login page) in Oi! Email Marketing System 3.0 (aka Oi! 3) allows remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.", "edition": 3, "cvss3": {}, "published": "2006-02-28T11:02:00", "title": "CVE-2006-0919", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2006-0919"], "modified": "2018-10-18T16:29:00", "cpe": ["cpe:/a:oi:email_marketing_system:3.0"], "id": "CVE-2006-0919", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0919", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:oi:email_marketing_system:3.0:*:*:*:*:*:*:*"]}]}