Published: 27/04/2006 Updated: 18/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in save.php in PHPSurveyor 0.995 and previous versions allows remote malicious users to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal sequences into the database, which are then processed by the thissurvey['language'] variable.

Vulnerable Product	Search on Vulmon	Subscribe to Product
phpsurveyor phpsurveyor 0.99
phpsurveyor phpsurveyor 0.97 beta
phpsurveyor phpsurveyor 0.96 beta
phpsurveyor phpsurveyor 0.992
phpsurveyor phpsurveyor 0.995
phpsurveyor phpsurveyor 0.993
phpsurveyor phpsurveyor 0.991
phpsurveyor phpsurveyor 0.98 stable
phpsurveyor phpsurveyor 0.98 beta

#!/usr/bin/php -q -d short_open_tag=on <? echo "********************************************************************\r\n"; echo "* PHPSurveyor <= 0995 'savephp/surveyid' remote cmmnds xctn *\r\n"; echo "* by rgod rgod@autisticiorg site: retrogodaltervistaorg *\r\n"; echo "* a special tnX goes to Frozen for his dork! ...

NVD-CWE-Other http://retrogod.altervista.org/phpsurveyor_0995_xpl.html http://securitytracker.com/id?1015970 http://secunia.com/advisories/19761 http://www.securityfocus.com/bid/17633 http://www.osvdb.org/24787 http://www.vupen.com/english/advisories/2006/1451 https://exchange.xforce.ibmcloud.com/vulnerabilities/25970 http://www.securityfocus.com/archive/1/431508/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/1701/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2006-2065

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect