CVE-2006-0444

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 3.0%

from disclosure to weapon0 days

Published on NVDJan 26

1st PoCJan 25

exploitation probability

3.0%top 14% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/1453

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/18597 https://exchange.xforce.ibmcloud.com/vulnerabilities/24355 http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt http://www.osvdb.org/22720 http://www.osvdb.org/22722 http://www.securityfocus.com/archive/1/423145/100/0/threaded http://www.securityfocus.com/bid/16391 http://www.vupen.com/english/advisories/2006/0342