Multiple SQL injection vulnerabilities in All In One Control Panel...
Vulnerability Description
Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) choosed_language parameter to (a) cp_dpage.php, (b) cp_news.php, (c) cp_forum_view.php, (d) cp_edit_user.php, (e) cp_newsletter.php, (f) cp_links.php, (g) cp_contact_us.php, (h) cp_login.php, and (i) cp_codice_fiscale.php in public/code/; (2) news_category parameter to public/code/cp_news.php; (3) nlmsg_nlcatid parameter to public/code/cp_newsletter.php; (4) links_category parameter to public/code/cp_links.php; (5) product_category_id parameter to public/code/cp_show_ec_products.php; (6) order_field parameter to public/code/cp_show_ec_products.php; (7) firstrow parameter to public/code/cp_users_online.php; and (8) orderdir parameter to public/code/cp_links_search.php.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-5829
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.vupen.com/english/advisories/2006/4378
- http://www.securityfocus.com/archive/1/450701/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30051
- http://sourceforge.net/project/shownotes.php?release_id=478370
- http://securityreason.com/securityalert/1839
- http://secunia.com/advisories/22719
- http://www.securityfocus.com/bid/20931
More from aiocp
View All →Affected Vendor
aiocp
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.