CVE-2006-4142 SQL injection vulnerability in extra/online.php in Virtual War (VWar) 1.5.0 R14 and earlier allows remote attackers to execute arbitrary SQL commands via the n parameter.
HighCVSS 7.5
EPSS 1.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in extra/online.php in Virtual War (VWar) 1.5.0 R14 and earlier allows remote attackers to execute arbitrary SQL commands via the n parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vwar virtual war | = 1.5.0 | No fix listed |
| vwar virtual war | = 1.5.0_r1 | No fix listed |
| vwar virtual war | = 1.5.0_r2 | No fix listed |
| vwar virtual war | = 1.5.0_r3 | No fix listed |
| vwar virtual war | = 1.5.0_r4 | No fix listed |
| vwar virtual war | = 1.5.0_r5 | No fix listed |
| vwar virtual war | = 1.5.0_r6 | No fix listed |
| vwar virtual war | = 1.5.0_r7 | No fix listed |
| vwar virtual war | = 1.5.0_r8 | No fix listed |
| vwar virtual war | = 1.5.0_r9 | No fix listed |
| vwar virtual war | = 1.5.0_r10 | No fix listed |
| vwar virtual war | = 1.5.0_r11 | No fix listed |
| vwar virtual war | = 1.5.0_r12 | No fix listed |
| vwar virtual war | = 1.5.0_r13 | No fix listed |
| vwar virtual war | = 1.5.0_r14 | No fix listed |
References
- 1384 third-party-advisory
- 20070413 DUP?: [waraxe-2007-SA#048] - Multiple vulnerabilities in Virtual War 1.5 module for PhpNuke mailing-list
- 20060811 VWar <= 1.50 R14 (n) Remote SQL Injection mailing-list
- 19472 exploit vdb-entry
- www.vwar.de
- virtualwar-online-sql-injection(28323) vdb-entry
- 2170 exploit