Multiple SQL injection vulnerabilities in userscript.php in Green Minute 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) huserid, (2) pituus, or (3) date parameters. NOTE: this issue has been disputed by the vendor, saying "those parameters mentioned ARE checked (preg_match) before they are used in SQL-query... If someone decided to add SQL-injection stuff to certain parameter, they would see an error text, but only because _nothing_ was passed inside that parameter (to MySQL-database)." As allowed by the vendor, CVE investigated this report on 20060525 and found that the demo site demonstrated a non-sensitive SQL error when given standard SQL injection manipulations
Published 2006-04-20 18:06:00
Updated 2024-05-17 00:28:21
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Sql Injection

Exploit prediction scoring system (EPSS) score for CVE-2006-1930

0.51%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-1930

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.4
MEDIUM AV:N/AC:L/Au:N/C:P/I:P/A:N
10.0
4.9
NIST

Products affected by CVE-2006-1930

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!