Summary
The remote web server contains a PHP script that is affected by a SQL injection vulnerability.
Description:
The remote web server is running Etomite CMS, a PHP-based content management system.
The version of Etomite CMS installed on the remote host fails to sanitize input to the 'id' parameter before using it in the 'index.php' script in a database query. Provided PHP's 'magic_quotes_gpc' setting is disabled, an unauthenticated attacker can exploit this issue to manipulate SQL queries, possibly leading to disclosure of sensitive data, attacks against the underlying database, and the like.
Solution
No patches or upgrades have been reported by the vendor at this time.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2006-6048 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities
- Apache Struts Cross Site Scripting Vulnerability
- Abtp Portal Project 'ABTPV_BLOQUE_CENT' Parameter Local and Remote File Include Vulnerabilities
- Adobe BlazeDS XML and XML External Entity Injection Vulnerabilities
- AfterLogic WebMail Pro Multiple Cross Site Scripting Vulnerabilities
- Apache CouchDB Cross Site Request Forgery Vulnerability