SQL injection vulnerability in the do_mysql_query function in core.php for...
Vulnerability Description
SQL injection vulnerability in the do_mysql_query function in core.php for Open Searchable Image Catalogue (OSIC) before 0.7.0.1 allows remote attackers to inject arbitrary SQL commands via multiple vectors, as demonstrated by the (1) type parameter in adminfunctions.php and the (2) catalogue_id parameter in editcatalogue.php.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-2748
Credits & Attribution
No credits recorded in the NVD database.
References
- http://sourceforge.net/forum/forum.php?forum_id=576483
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26968
- http://www.securityfocus.com/archive/1/435380/100/0/threaded
- http://secunia.com/advisories/20341
- http://www.seclab.tuwien.ac.at/advisories/TUVSA-0605-001.txt
- http://securitytracker.com/id?1016178
- http://securityreason.com/securityalert/1014
- http://www.securityfocus.com/bid/18169
- http://svn.sourceforge.net/viewcvs.cgi/osic-win/branches/osic_0-7/osic/core.php?r1=477&r2=631
More from open searchable image catalogue
View All →Affected Vendor
open searchable image catalogue
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.