Back to Database
Status published
Medium
CVE-2006-1676
SQL injection vulnerability in the display function in the Topics...
Vulnerability Description
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-1676
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.securityfocus.com/bid/17399
- http://www.maxdev.com/Article592.phtml
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25710
- http://www.securityfocus.com/archive/1/437831/100/100/threaded
- http://secunia.com/advisories/19578
- http://www.securityfocus.com/archive/1/430370/100/0/threaded
- http://www.vupen.com/english/advisories/2006/1282
More from maxdev
View All →CVE-2009-4577
SQL injection vulnerability in the MDForum module 2.x through 2.07...
High
7.5
CVE-2009-2618
SQL injection vulnerability in the Surveys (aka NS-Polls) module in...
High
7.5
CVE-2009-2307
SQL injection vulnerability in the CWGuestBook module 2.1 and earlier...
High
7.5
CVE-2009-0728
SQL injection vulnerability in the My_eGallery module for MAXdev MDPro...
High
7.5
CVE-2008-7038
SQL injection vulnerability in the My_eGallery module for PHP-Nuke allows...
High
7.5
Affected Vendor
maxdev
View all reports →Affected Software
md-pro
Vulnerable Versions:
0, 1.0.72, 1.0.73
Timeline
Official Publish:
April 10th, 2006
Last Modified:
August 7th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.