CVE-2006-4953

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• NeoSys Neon Webmail for Java 5.06/5.07 - 'maillist' Servlet Multiple SQL Injections2006-09-20 · webapps · jsp · Verified
• NeoSys Neon Webmail for Java 5.06/5.07 - 'addrlist' Servlet Multiple SQL Injections2006-09-20 · webapps · jsp · Verified

Impact

Multiple SQL injection vulnerabilities in Neon WebMail for Java before 5.08 allow remote attackers to execute arbitrary SQL commands via the (1) adr_sortkey and (2) adr_sortkey_desc parameters in the (a) addrlist servlet, and the (3) sortkey and (4) sortkey_desc parameters in the (b) maillist servlet.

Affected products

References

• NVD record
• CVE.org record
• http://secunia.com/advisories/22029
• http://vuln.sg/neonmail506-en.html
• http://www.securityfocus.com/bid/20109
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29088
• http://secunia.com/advisories/22029
• http://vuln.sg/neonmail506-en.html
• http://www.securityfocus.com/bid/20109
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29088