National Cyber Awareness System

Vulnerability Summary for CVE-2006-2731

Overview

Multiple SQL injection vulnerabilities in Enigma Haber 4.3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in (a) e_mesaj_yas.asp, (b) edi_haber.asp, and (c) haber_devam.asp; (2) hid parameter in (d) yazdir.asp and (e) yorum.asp, and the (3) e parameter in (f) arsiv.asp. NOTE: with administrator credentials, additional vectors exist including (4) yid parameter to (g) admin/y_admin.asp, (5) bid parameter to (h) admin/reklam_detay.asp, hid parameter to (i) admin/detay_yorum.asp and (j) admin/haber_sil.asp, (6) kid parameter to (k) admin/kategori_d.asp, (7) tur parameter to (l) admin/haber_ekle.asp, (8) s parameter to (m) admin/e_mesaj_yaz.asp, and id parameter to (n) admin/admin_sil.asp.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2006-2032

Hyperlink:http://www.vupen.com/english/advisories/2006/2032

External Source: BID

Name: 18148

Hyperlink:http://www.securityfocus.com/bid/18148

External Source: BUGTRAQ

Name: 20060528 Advisory: Enigma Haber <= 4.3 Multiple Remote SQL InjectionVulnerabilities

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/435282/100/0/threaded

External Source: MISC

Name: http://www.nukedx.com/?viewdoc=34

Hyperlink:http://www.nukedx.com/?viewdoc=34

External Source: MISC

Name: http://www.nukedx.com/?getxpl=34

Hyperlink:http://www.nukedx.com/?getxpl=34

External Source: SECTRACK

Name: 1016171

Hyperlink:http://securitytracker.com/id?1016171

External Source: SECUNIA

Name: 20357

Type: Advisory; Exploit

Hyperlink:http://secunia.com/advisories/20357

External Source: XF

Name: enigmahaber-multiple-sql-injection(26837)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26837

External Source: OSVDB

Name: 26119

Hyperlink:http://www.osvdb.org/26119

External Source: OSVDB

Name: 26118

Hyperlink:http://www.osvdb.org/26118

External Source: OSVDB

Name: 26117

Hyperlink:http://www.osvdb.org/26117

External Source: OSVDB

Name: 26116

Hyperlink:http://www.osvdb.org/26116

External Source: OSVDB

Name: 26115

Hyperlink:http://www.osvdb.org/26115

External Source: OSVDB

Name: 26114

Hyperlink:http://www.osvdb.org/26114

External Source: OSVDB

Name: 26113

Hyperlink:http://www.osvdb.org/26113

External Source: OSVDB

Name: 26112

Hyperlink:http://www.osvdb.org/26112

External Source: OSVDB

Name: 26111

Hyperlink:http://www.osvdb.org/26111

External Source: OSVDB

Name: 26110

Hyperlink:http://www.osvdb.org/26110

External Source: OSVDB

Name: 26109

Hyperlink:http://www.osvdb.org/26109

External Source: OSVDB

Name: 26108

Hyperlink:http://www.osvdb.org/26108

External Source: OSVDB

Name: 26107

Hyperlink:http://www.osvdb.org/26107

External Source: OSVDB

Name: 26106

Hyperlink:http://www.osvdb.org/26106

External Source: SREASON

Name: 1003

Hyperlink:http://securityreason.com/securityalert/1003