CVE-2006-6090 Multiple SQL injection vulnerabilities in BaalAsp forum allow remote attackers to execute arbitrary SQL commands via the (1) password parameter to (a) adminlogin.asp, the (2) name or (3) password para...
HighCVSS 7.5
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in BaalAsp forum allow remote attackers to execute arbitrary SQL commands via the (1) password parameter to (a) adminlogin.asp, the (2) name or (3) password parameter to (b) userlogin.asp, or the (3) search parameter to search.asp.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| baalasp smart form portal | All versions | No fix listed |
References
- s-a-p.ca exploit url-repurposed vendor-advisory
- 22943 third-party-advisory vendor-advisory
- 1913 third-party-advisory
- 20061115 BaalAsp forum [login bypass ,injections sql(post), xss(post)] mailing-list
- 21111 exploit vdb-entry
- ADV-2006-4579 vdb-entry
- baalasp-login-security-bypass(30342) vdb-entry
- baalasp-search-sql-injection(30343) vdb-entry