high7.5Public exploit code
CVE-2006-1111
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, which reveals usernames and passwords in…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Aztek Forum 4.00 - Cross-Site Scripting / SQL Injection2006-03-02 · webapps · php · Verified
Impact
Aztek Forum 4.0 allows remote attackers to obtain sensitive information via a "*/*" in the msg parameter to index.php, which reveals usernames and passwords in a MySQL error message, possibly due to a forced SQL error or SQL injection.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Aztek Forum | Aztek Forum | Version 4.0 |
References
- NVD record
- CVE.org record
- http://www.osvdb.org/23611
- http://www.securityfocus.com/archive/1/426650/100/0/threaded
- http://www.securityfocus.com/bid/16938
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25036
- https://www.exploit-db.com/exploits/1547
- http://www.osvdb.org/23611
- http://www.securityfocus.com/archive/1/426650/100/0/threaded
- http://www.securityfocus.com/bid/16938
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25036
- https://www.exploit-db.com/exploits/1547