ByteOS Network

NVD Vulnerability Details :

CVE-2006-6177

Modified

Source-cve@mitre.org

Published At-30 Nov, 2006 | 16:28

Updated At-17 Oct, 2018 | 21:47

SQL injection vulnerability in system/core/users/users.profile.inc.php in Neocrome Seditio 1.10 and earlier allows remote authenticated users to execute arbitrary SQL commands via a double-url-encoded id parameter to users.php that begins with a valid filename, as demonstrated by "default.gif" followed by an encoded NULL and ' (apostrophe) (%2500%2527).

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

neocrome>>seditio>>Versions up to 1.10(inclusive)

cpe:2.3:a:neocrome:seditio:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-Other	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://secunia.com/advisories/23054	cve@mitre.org	Patch Vendor Advisory
http://securityreason.com/securityalert/1931	cve@mitre.org	N/A
http://www.neocrome.net/page.php?id=2233	cve@mitre.org	N/A
http://www.nukedx.com/?getxpl=52	cve@mitre.org	Exploit
http://www.nukedx.com/?viewdoc=52	cve@mitre.org	Exploit
http://www.securityfocus.com/archive/1/452269/100/100/threaded	cve@mitre.org	N/A
http://www.vupen.com/english/advisories/2006/4668	cve@mitre.org	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/30466	cve@mitre.org	N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History