Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.8
CVSSv2

CVE-2006-1278

Published: 19/03/2006 Updated: 18/10/2018
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 685
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Upoint

Vulnerability Summary

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote malicious users to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.

Vulnerable Product Search on Vulmon Subscribe to Product

upoint \\@1 file store 2006.03.07

Exploits

Exploit DB: File Store PRO 3.2 - Multiple Blind SQL Injections
________________________________________ | File Store PRO 32 Blind SQL Injection | |________________________________________| Download from: upointinfo/cgi/demo/fs/filestorezip - Need admin rights: /confirmphp: [code] if(isset($_GET["folder"]) && $_GET["folder"]!="") { $folder=$_GET["folder"]; } else { exit("Bad Request") ...

References

CWE-89http://evuln.com/vulns/95/summary.htmlhttp://secunia.com/advisories/19224http://www.osvdb.org/23851http://www.osvdb.org/23852http://www.osvdb.org/23853http://www.osvdb.org/23854http://www.osvdb.org/23855http://www.osvdb.org/23856http://www.osvdb.org/23857http://www.osvdb.org/23858http://www.osvdb.org/23859http://www.osvdb.org/23860http://www.osvdb.org/23861http://www.osvdb.org/23862http://www.osvdb.org/23863http://www.osvdb.org/23864http://securitytracker.com/id?1015826http://www.securityfocus.com/bid/17090http://www.osvdb.org/24106http://securityreason.com/securityalert/619http://osvdb.org/47017http://www.attrition.org/pipermail/vim/2009-August/002246.htmlhttp://osvdb.org/47018http://www.securityfocus.com/bid/30182http://secunia.com/advisories/31063http://www.vupen.com/english/advisories/2006/0943https://exchange.xforce.ibmcloud.com/vulnerabilities/43724https://exchange.xforce.ibmcloud.com/vulnerabilities/43718https://exchange.xforce.ibmcloud.com/vulnerabilities/25183https://www.exploit-db.com/exploits/6040http://www.securityfocus.com/archive/1/428659/100/0/threadedhttps://nvd.nist.govhttps://www.exploit-db.com/exploits/6040/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2020-4463CVE-2024-29895injectCVE-2023-52689CVE-2024-5049CVE-2024-5051privilege escalationphysicalCVE-2023-52676
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook