CVE-2006-3027

EPSS 2.6%

Multiple SQL injection vulnerabilities in Enthrallwebe ePhotos 2.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) CAT_ID parameter in (a) subphotos.asp and (b) subLevel2.asp, the (2) AL_ID parameter in (c) photo.asp, and the (3) SUB_ID parameter in (d) subLevel2.asp.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/2986unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://pridels0.blogspot.com/2006/06/ephotos-vuln.html http://secunia.com/advisories/20609 http://secunia.com/advisories/23525 https://exchange.xforce.ibmcloud.com/vulnerabilities/27035 https://www.exploit-db.com/exploits/2986 http://www.osvdb.org/26365 http://www.osvdb.org/26366 http://www.osvdb.org/26367 http://www.securityfocus.com/bid/21742 http://www.vupen.com/english/advisories/2006/2316 http://www.vupen.com/english/advisories/2006/5160