medium6.5
CVE-2006-3828
Incomplete blacklist vulnerability in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote authenticated administrators to bypass SQL in…
Impact
Incomplete blacklist vulnerability in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote authenticated administrators to bypass SQL injection protection mechanisms by using commas, quote characters, pound sign (#) characters, "UNION," and "SELECT," which are not filtered by the product, which only checks for "insert," "delete," "update," and "replace."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kailash Nadh | Boastmachine | Versions 2.5, 2.7, 2.8, 2.9b, 3.1 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/21066
- http://securityreason.com/securityalert/1252
- http://securitytracker.com/id?1016515
- http://www.acid-root.new.fr/advisories/boastmachine.txt
- http://www.securityfocus.com/archive/1/440306/100/0/threaded
- http://www.vupen.com/english/advisories/2006/2849
- http://secunia.com/advisories/21066
- http://securityreason.com/securityalert/1252
- http://securitytracker.com/id?1016515
- http://www.acid-root.new.fr/advisories/boastmachine.txt
- http://www.securityfocus.com/archive/1/440306/100/0/threaded
- http://www.vupen.com/english/advisories/2006/2849