CVE-2006-2065

Published Apr 27, 2006

Last updated 6 years ago

Overview

Description: SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal sequences into the database, which are then processed by the thissurvey['language'] variable.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.96_beta:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1F82FE01-FC91-4259-A53D-4D03FCB0DCCA"
          },
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.97_beta:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "086A5B9A-B3A2-42FC-B76C-D61225217762"
          },
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.98_beta:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7DAD67BC-BA23-4692-B333-D5F412DB7B88"
          },
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.98_stable:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F9467C7F-8283-4717-AA0F-AB1E745C5CA4"
          },
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.99:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1BA0CC28-1114-4CFC-B445-2FDF5D972AD3"
          },
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.991:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1CCB1FA7-3DA0-42C1-B426-B07A15C86F0A"
          },
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.992:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BDAC784E-B1D7-486E-940C-09BC34855BBF"
          },
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.993:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B6D7CDFC-5911-431E-ABD9-E864A71F8146"
          },
          {
            "criteria": "cpe:2.3:a:phpsurveyor:phpsurveyor:0.995:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8A0EF001-46CB-4D68-B451-5206E8F6DD3C"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References