CVE-2006-6486

{"id": "CVE-2006-6486", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-12-12T20:28:00.000", "references": [{"url": "http://www.securityfocus.com/archive/1/453575/100/100/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/453586/100/100/threaded", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30755", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/453575/100/100/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/453586/100/100/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30755", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter. NOTE: this issue appears to have been disputed by a third party researcher, stating that SQL injection is not possible. However, insufficient details were provided to evaluate the dispute."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en EasyPage permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n mediante vectores sin especificar en el sptrees/default.aspx, posiblemente involucrando el par\u00e1metro docId. NOTA: esta vulnerabilidad parece haber sido impugnada por investigadores terceros, estableciendo que inyecciones de SQL no son posibles. Sin embargo, no han sido proporcionados suficientes detalles para la evaluaci\u00f3n de la impugnaci\u00f3n.\r\n"}], "lastModified": "2024-11-21T00:22:48.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:easypage:easypage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38B57BB9-C403-401C-AD84-5B3F4E04A34C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}