CVE-2006-1104

State: Published
Severity: Not scored
Published: Mar 9, 2006
Updated: Aug 7, 2024
Reserved: Mar 9, 2006

Description

Multiple SQL injection vulnerabilities in Pixelpost 1.5 beta 1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the showimage parameter in index.php; and the (2) USER_AGENT, (3) HTTP_REFERER, and (4) HTTP_HOST HTTP header fields as used in the book_vistor function in includes/functions.php. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://forum.pixelpost.org/showthread.php?t=3535
http://www.neosecurityteam.net/index.php?action=advisories&id=19
pixelpost-functions-sql-injection(25046)vdb-entry
20060304 Pixel Post Multiple Vulnerabilitiesmailing-list
16964vdb-entry
ADV-2006-0823vdb-entry
pixelpost-index-sql-injection(25044)vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.