CVE-2006-4244 - CVE House
Back to Database
Status published High CVE-2006-4244

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the...

Vulnerability Description

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-4244

Credits & Attribution

No credits recorded in the NVD database.

References

More from sql-ledger

View All →
CVE-2009-4402
The default configuration of SQL-Ledger 2.8.24 allows remote attackers to...
High 7.5
CVE-2009-3584
SQL-Ledger 2.8.24 does not set the secure flag for the...
Medium 5
CVE-2009-3583
Directory traversal vulnerability in the Preferences menu item in SQL-Ledger...
Medium 5.1
CVE-2009-3582
Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger...
Medium 6.5
CVE-2009-3581
Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote...
Low 3.5

Affected Vendor

Affected Software

sql-ledger
Vulnerable Versions:
2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17

Timeline

Official Publish: August 31st, 2006
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.