CVE-2006-6486 SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter. NOTE: this is...
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in EasyPage allows remote attackers to execute arbitrary SQL commands via unspecified vectors in sptrees/default.aspx, possibly involving the docId parameter. NOTE: this issue appears to have been disputed by a third party researcher, stating that SQL injection is not possible. However, insufficient details were provided to evaluate the dispute.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| easypage | All versions | No fix listed |
References
- 20061205 EasyPage Portal ( all ver )SQL Injection mailing-list
- 20061205 Re: EasyPage Portal ( all ver )SQL Injection mailing-list
- easypageportal-unspecified-sql-injection(30755) vdb-entry