Summary
The remote web server contains a PHP script that is affected by a SQL injection vulnerability.
Description:
The remote web server is running Etomite CMS, a PHP-based content management system.
The version of Etomite CMS installed on the remote host fails to sanitize input to the 'id' parameter before using it in the 'index.php' script in a database query. Provided PHP's 'magic_quotes_gpc' setting is disabled, an unauthenticated attacker can exploit this issue to manipulate SQL queries, possibly leading to disclosure of sensitive data, attacks against the underlying database, and the like.
Solution
No patches or upgrades have been reported by the vendor at this time.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2006-6048 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- 1024 CMS 1.1.0 Beta 'force_download.php' Local File Include Vulnerability
- AeroMail Cross Site Request Forgery, HTML Injection and Cross Site Scripting Vulnerabilities
- Aker Secure Mail Gateway Cross-Site Scripting Vulnerability
- @Mail 'admin.php' Cross-Site Scripting Vulnerabilities
- 3Com NBX VoIP NetSet Detection