CVEvulnerability
CVE-2006-3135
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2006-07-13
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Multiple SQL injection vulnerabilities in CMS Mundo 1.0 build 008, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter in the (a) news module, (2) searchstring parameter in (b) the search module, (3) id parameter in (c) the webshop module, (4) username parameter in (d) index.php, and (5) Name, (6) Address, (7) Zip, (8) City, (9) Country, and (10) Email fields during (e) a user profile update.
Affected configurations
• hotwebscripts cms mundo 1.0 build 008
References
- http://secunia.com/advisories/20589 Exploit, Vendor Advisory
- http://secunia.com/secunia_research/2006-52/advisory/ Vendor Advisory
- http://securityreason.com/securityalert/1236 securityreason.com
- http://www.osvdb.org/27139 www.osvdb.org
- http://www.osvdb.org/27140 www.osvdb.org
- http://www.osvdb.org/27141 www.osvdb.org
- http://www.osvdb.org/27142 www.osvdb.org
- http://www.osvdb.org/27143 www.osvdb.org
- http://www.vupen.com/english/advisories/2006/2783 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27712 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/20589 Exploit, Vendor Advisory
- http://secunia.com/secunia_research/2006-52/advisory/ Vendor Advisory
- http://securityreason.com/securityalert/1236 securityreason.com
- http://www.osvdb.org/27139 www.osvdb.org
- http://www.osvdb.org/27140 www.osvdb.org
- http://www.osvdb.org/27141 www.osvdb.org
- http://www.osvdb.org/27142 www.osvdb.org
- http://www.osvdb.org/27143 www.osvdb.org
- http://www.vupen.com/english/advisories/2006/2783 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27712 exchange.xforce.ibmcloud.com