high7.5Public exploit code
CVE-2006-6066
Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the (1) username or…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dragon Internet Events Listing 2.0.01 - 'admin_login.asp' Multiple Field SQL Injections2006-11-15 · webapps · asp · Verified
- Dragon Internet Events Listing 2.0.01 - 'event_searchdetail.asp?ID' SQL Injection2006-11-15 · webapps · asp · Verified
- Dragon Internet Events Listing 2.0.01 - 'venue_detail.asp?VenueID' SQL Injection2006-11-15 · webapps · asp · Verified
Impact
Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) admin_login.asp, the (3) ID parameter to (b) event_searchdetail.asp, or the (4) VenueID parameter to (c) venue_detail.asp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dragon Internet | Events Listing | Version 2.0.01 |
References
- NVD record
- CVE.org record
- http://s-a-p.ca/index.php?page=OurAdvisories&id=32
- http://secunia.com/advisories/22930
- http://www.osvdb.org/30443
- http://www.osvdb.org/30444
- http://www.osvdb.org/30445
- http://www.securityfocus.com/archive/1/451632/100/100/threaded
- http://www.securityfocus.com/bid/21098
- http://www.vupen.com/english/advisories/2006/4533
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30296
- http://s-a-p.ca/index.php?page=OurAdvisories&id=32
- http://secunia.com/advisories/22930
- http://www.osvdb.org/30443
- http://www.osvdb.org/30444
- http://www.osvdb.org/30445
- http://www.securityfocus.com/archive/1/451632/100/100/threaded
- http://www.securityfocus.com/bid/21098
- http://www.vupen.com/english/advisories/2006/4533
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30296