CVE-2006-5629

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 3.0%

from disclosure to weapon0 days

Published on NVDOct 31

1st PoCOct 27

exploitation probability

3.0%top 14% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands via the ForumID parameter in (1) DisableForum.asp and (2) enableForum.asp. NOTE: it was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/2662 cve_referencewww.exploit-db.com/exploits/4730unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html http://secunia.com/advisories/22607 http://secunia.com/advisories/28973 http://securitytracker.com/id?1017103 https://exchange.xforce.ibmcloud.com/vulnerabilities/39036 https://www.exploit-db.com/exploits/4730 http://www.kapda.ir/advisory-442.html http://www.securityfocus.com/archive/1/485028/100/0/threaded http://www.securityfocus.com/bid/20661 http://www.securityfocus.com/bid/26862 http://www.vupen.com/english/advisories/2006/4296