high7.5Public exploit code
CVE-2006-2179
Multiple SQL injection vulnerabilities in CyberBuild allow remote attackers to execute arbitrary SQL commands via the (1) SessionID parameter to login.asp or (…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CyberBuild - 'browse0.htm?ProductIndex' SQL Injection2006-05-03 · webapps · asp · Verified
- CyberBuild - 'login.asp?sessionid' SQL Injection2006-05-03 · webapps · asp · Verified
Impact
Multiple SQL injection vulnerabilities in CyberBuild allow remote attackers to execute arbitrary SQL commands via the (1) SessionID parameter to login.asp or (2) ProductIndex parameter to browse0.htm.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Smartwin Technology | Cyberoffice Warehouse Builder | All versions |
References
- NVD record
- CVE.org record
- http://pridels0.blogspot.com/2006/05/cyberbuild-vuln.html
- http://secunia.com/advisories/19889
- http://www.osvdb.org/25195
- http://www.osvdb.org/25196
- http://www.securityfocus.com/bid/17829
- http://www.vupen.com/english/advisories/2006/1630
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26201
- http://pridels0.blogspot.com/2006/05/cyberbuild-vuln.html
- http://secunia.com/advisories/19889
- http://www.osvdb.org/25195
- http://www.osvdb.org/25196
- http://www.securityfocus.com/bid/17829
- http://www.vupen.com/english/advisories/2006/1630
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26201