CVE-2006-5500 Multiple SQL injection vulnerabilities in the checkUser function in inc/DBInterface.php in XchangeBoard 1.70 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary...

MediumCVSS 5.1 EPSS 0.89%

Published: 2006-10-25 13:00
Updated: 2026-06-17 01:31
Exploit status: No public exploit known

Description

Multiple SQL injection vulnerabilities in the checkUser function in inc/DBInterface.php in XchangeBoard 1.70 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) userNick or (2) password parameters. NOTE: the provenance of this information is unknown; the details are obtained from third party information.

Affected products

Product	Affected versions	Fixed in
xchangeboard	<= 1.70	No fix listed

References

ADV-2006-4129 vdb-entry

CVSS v2.0

5.1 Medium

AV:N/AC:H/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: High
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.89% (percentile 59.9)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.