CVE-2006-1278

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 3.7%

exploitation probability

3.7%top 11% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/6040

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://evuln.com/vulns/95/summary.html http://osvdb.org/47017 http://osvdb.org/47018 http://secunia.com/advisories/19224 http://secunia.com/advisories/31063 http://securityreason.com/securityalert/619 http://securitytracker.com/id?1015826 https://exchange.xforce.ibmcloud.com/vulnerabilities/25183 https://exchange.xforce.ibmcloud.com/vulnerabilities/43718 https://exchange.xforce.ibmcloud.com/vulnerabilities/43724 https://www.exploit-db.com/exploits/6040 http://www.attrition.org/pipermail/vim/2009-August/002246.html