Unscored CVE-2006-2565 EUVD-2006-2565GHSA-2652-4r69-fm9r

SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via (1) the aut…

Published May 24, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

SQL injection vulnerability in Alstrasoft Article Manager Pro 1.6 allows remote attackers to execute arbitrary SQL commands via (1) the author_id parameter in profile.php and (2) the aut_id parameter in userarticles.php. NOTE: the aut_id vector can produce resultant path disclosure if the SQL manipulation is invalid.

References

949 third-party-advisory
article-manager-profile-sql-injection(26674) vdb-entry
20228 third-party-advisory
ADV-2006-1943 vdb-entry
article-manager-multi-scripts-path-disclosure(26676) vdb-entry
20060522 Alstrasoft Article Manager Pro v1.6 mailing-list