CVE

Id
18169  
CVE No.
CVE-2006-2065  
Status
Candidate  
Description
SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal sequences into the database, which are then processed by the thissurvey["language"] variable.  
Phase
Assigned (20060426)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
156547 18169 CVE-2006-2065 BUGTRAQ:20060420 PHPSurveyor <= 0.995 "save.php/surveyid" remote cmmnds xctn  View
156548 18169 CVE-2006-2065 URL:http://www.securityfocus.com/archive/1/archive/1/431508/100/0/threaded  View
156549 18169 CVE-2006-2065 MISC:http://retrogod.altervista.org/phpsurveyor_0995_xpl.html  View
156550 18169 CVE-2006-2065 BID:17633  View
156551 18169 CVE-2006-2065 URL:http://www.securityfocus.com/bid/17633  View
156552 18169 CVE-2006-2065 VUPEN:ADV-2006-1451  View
156553 18169 CVE-2006-2065 URL:http://www.vupen.com/english/advisories/2006/1451  View
156554 18169 CVE-2006-2065 OSVDB:24787  View
156555 18169 CVE-2006-2065 URL:http://www.osvdb.org/24787  View
156556 18169 CVE-2006-2065 SECTRACK:1015970  View
156557 18169 CVE-2006-2065 URL:http://securitytracker.com/id?1015970  View
156558 18169 CVE-2006-2065 SECUNIA:19761  View
156559 18169 CVE-2006-2065 URL:http://secunia.com/advisories/19761  View
156560 18169 CVE-2006-2065 XF:phpsurveyor-surveyid-shell-execution(25970)  View

Related JVN