CVE-2006-2268

Published May 9, 2006

Last updated 6 years ago

Overview

Description: SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably involving the (1) checkuser and (2) checkpass parameters to (a) admin/index.php, and (3) username and (4) password parameters to (b) index.php. NOTE: it was later reported that 0.0.6 is also affected.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 7.5
Impact score: 6.4
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-89

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:flexcustomer:flexcustomer:0.0.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "56A8FB0A-6798-4DD1-89D0-05D13A4775D3"
          },
          {
            "criteria": "cpe:2.3:a:flexcustomer:flexcustomer:0.0.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F3CC29E2-E623-40A7-9045-7A54C391103D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References