high7.5Public exploit code
CVE-2006-6937
SQL injection vulnerability in displaypic.asp in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary SQL commands via the sortorder parameter.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Xtreme ASP Photo Gallery 2.0 - 'displaypic.asp?sortorder' SQL Injection2006-11-16 · webapps · asp · Verified
Impact
SQL injection vulnerability in displaypic.asp in Xtreme ASP Photo Gallery allows remote attackers to inject arbitrary SQL commands via the sortorder parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pensacola Web Designs | Xtremeasp Photogallery | Version 2.0 |
References
- NVD record
- CVE.org record
- http://aria-security.net/advisory/xtremeg.txt
- http://securityreason.com/securityalert/2148
- http://www.osvdb.org/31507
- http://www.securityfocus.com/archive/1/451786/100/0/threaded
- http://www.securityfocus.com/bid/21138
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30324
- http://aria-security.net/advisory/xtremeg.txt
- http://securityreason.com/securityalert/2148
- http://www.osvdb.org/31507
- http://www.securityfocus.com/archive/1/451786/100/0/threaded
- http://www.securityfocus.com/bid/21138
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30324