CVE

Id
19766  
CVE No.
CVE-2006-3662  
Status
Candidate  
Description
** DISPUTED ** SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code suggests that this issue may be legitimate, and the parameter is cleansed in 1.5.3.1.  
Phase
Assigned (20060717)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
179384 19766 CVE-2006-3662 BUGTRAQ:20060708 ATutor 1.5.3 Cross Site Scripting  View
179385 19766 CVE-2006-3662 URL:http://archives.neohapsis.com/archives/bugtraq/2006-07/0096.html  View
179386 19766 CVE-2006-3662 BUGTRAQ:20060711 Re: ATutor 1.5.3 Cross Site Scripting  View
179387 19766 CVE-2006-3662 URL:http://www.securityfocus.com/archive/1/archive/1/439873/100/100/threaded  View
179388 19766 CVE-2006-3662 BUGTRAQ:20060721 Re: ATutor 1.5.3 Cross Site Scripting  View
179389 19766 CVE-2006-3662 URL:http://www.securityfocus.com/archive/1/archive/1/440837/100/100/threaded  View
179390 19766 CVE-2006-3662 BID:18898  View
179391 19766 CVE-2006-3662 URL:http://www.securityfocus.com/bid/18898  View
179392 19766 CVE-2006-3662 OSVDB:28188  View
179393 19766 CVE-2006-3662 URL:http://www.osvdb.org/28188  View
179394 19766 CVE-2006-3662 XF:atutor-index-sql-injection(27620)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
58202 JVNDB-2006-000398 Sun Solaris の ypserv コマンドにおけるサービス運用妨害 (DoS) の脆弱性 Sun Solaris の ypserv コマンドには、Network Information Service (NIS) クライアントからの特定のリクエストを処理した際に、リクエストが適切に処理されず、ypserv プロセスがハングアップする、あるいはパフォーマンスが低下する脆弱性が存在します。 CVE-2006-3664 19766 5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-000398.html  View