National Cyber Awareness System

Vulnerability Summary for CVE-2006-0444

Overview

SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

Solution

A simple fix has been released on the Main PCW site available directly at <a href="http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1">http://www.phpclanwebsite.com/index.php?page=downloads&func=browselist&par=1</a> Please download and install imediately. Tech note: Filters id number (par) to contain numbers only. }

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 16391

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/16391

External Source: SECUNIA

Name: 18597

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/18597

External Source: VUPEN

Name: ADV-2006-0342

Hyperlink:http://www.vupen.com/english/advisories/2006/0342

External Source: BUGTRAQ

Name: 20060125 HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities

Type: Advisory; Exploit

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/423145/100/0/threaded

External Source: OSVDB

Name: 22722

Hyperlink:http://www.osvdb.org/22722

External Source: OSVDB

Name: 22720

Hyperlink:http://www.osvdb.org/22720

External Source: MISC

Name: http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt

Type: Advisory; Exploit

Hyperlink:http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt

External Source: XF

Name: phpclanwebsite-index-sql-injection(24355)

Hyperlink:http://xforce.iss.net/xforce/xfdb/24355