NVD脆弱性詳細

Exploit、PoC検索

Exploit DB

NVD脆弱性検索トップ

->

NVD脆弱性詳細

CVE-2006-1278

概要	SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.
概要	Successful exploitation requires that the "magic_quotes_gpc" parameter is disabled.
公表日	2006年3月19日20:06
登録日	2021年1月29日15:33
最終更新日	2018年10月19日1:31

CVSS2.0 : MEDIUM
スコア	6.8
ベクター	AV:N/AC:M/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
全ての特権を取得	いいえ
ユーザー権限を取得	いいえ
その他の権限を取得	いいえ
ユーザー操作が必要	いいえ

影響を受けるソフトウェアの構成

構成1		以上	以下	より上	未満
cpe:2.3:a:upoint:\@1_file_store:2006.03.07:::::::*

関連情報、対策とツール

No	URL	refsource	タグ
1	http://evuln.com/vulns/95/summary.html	MISC	Exploit
2	http://osvdb.org/47017	OSVDB
3	http://osvdb.org/47018	OSVDB
4	http://secunia.com/advisories/19224	SECUNIA	Vendor Advisory
5	http://secunia.com/advisories/31063	SECUNIA	Vendor Advisory
6	http://securityreason.com/securityalert/619	SREASON	Exploit
7	http://securitytracker.com/id?1015826	SECTRACK	Exploit
8	http://www.attrition.org/pipermail/vim/2009-August/002246.html	VIM
9	http://www.osvdb.org/23851	OSVDB	Exploit
10	http://www.osvdb.org/23852	OSVDB
11	http://www.osvdb.org/23853	OSVDB
12	http://www.osvdb.org/23854	OSVDB
13	http://www.osvdb.org/23855	OSVDB
14	http://www.osvdb.org/23856	OSVDB
15	http://www.osvdb.org/23857	OSVDB
16	http://www.osvdb.org/23858	OSVDB
17	http://www.osvdb.org/23859	OSVDB
18	http://www.osvdb.org/23860	OSVDB
19	http://www.osvdb.org/23861	OSVDB
20	http://www.osvdb.org/23862	OSVDB
21	http://www.osvdb.org/23863	OSVDB
22	http://www.osvdb.org/23864	OSVDB
23	http://www.osvdb.org/24106	OSVDB
24	http://www.securityfocus.com/archive/1/428659/100/0/threaded	BUGTRAQ
25	http://www.securityfocus.com/bid/17090	BID
26	http://www.securityfocus.com/bid/30182	BID	Exploit
27	http://www.vupen.com/english/advisories/2006/0943	VUPEN	Vendor Advisory
28	https://exchange.xforce.ibmcloud.com/vulnerabilities/25183	XF
29	https://exchange.xforce.ibmcloud.com/vulnerabilities/43718	XF
30	https://exchange.xforce.ibmcloud.com/vulnerabilities/43724	XF
31	https://www.exploit-db.com/exploits/6040	EXPLOIT-DB

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html