NVD

Id
60635  
Name
CVE-2006-1930  
Description
** DISPUTED ** Multiple SQL injection vulnerabilities in userscript.php in Green Minute 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) huserid, (2) pituus, or (3) date parameters. NOTE: this issue has been disputed by the vendor, saying "those parameters mentioned ARE checked (preg_match) before they are used in SQL-query... If someone decided to add SQL-injection stuff to certain parameter, they would see an error text, but only because _nothing_ was passed inside that parameter (to MySQL-database)." As allowed by the vendor, CVE investigated this report on 20060525 and found that the demo site demonstrated a non-sensitive SQL error when given standard SQL injection manipulations.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)  
Pub Date
2016-12-20  
Published
2006-04-20  
Modified Date
2008-11-03  
Seq
2006-1930  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
312889 60635 CVE-2006-1930 http://hoito.org/en/products/  View
312890 60635 CVE-2006-1930 http://pridels0.blogspot.com/2006/04/green-minute-sql-inj-vuln.html  View
312891 60635 CVE-2006-1930 greenminute-userscript-sql-injection(25942)  View

Related JVN