Vulnerability Details : CVE-2006-5736
SQL injection vulnerability in search.php in PunBB before 1.2.14, when the PHP installation is vulnerable to CVE-2006-3017, allows remote attackers to execute arbitrary SQL commands via the result_list array parameter, which is not initialized.
Vulnerability category: Sql Injection
Exploit prediction scoring system (EPSS) score for CVE-2006-5736
Probability of exploitation activity in the next 30 days: 1.36%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 85 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2006-5736
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
5.1
|
MEDIUM | AV:N/AC:H/Au:N/C:P/I:P/A:P |
4.9
|
6.4
|
NIST |
References for CVE-2006-5736
-
http://securitytracker.com/id?1017131
Exploit;Patch
- http://securityreason.com/securityalert/1824
- http://www.punbb.org/changelogs/1.2.13_to_1.2.14.txt
- http://www.vupen.com/english/advisories/2006/4256
- http://www.securityfocus.com/archive/1/450055/100/0/threaded
-
http://www.wargan.org/index.php/2006/10/29/4-punbb-1213-multiple-vulnerabilities
Exploit
Products affected by CVE-2006-5736
- cpe:2.3:a:punbb:punbb:*:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0_alpha:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0_beta1:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0_rc1:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0_rc2:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0_beta2:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0_beta3:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.0_beta1a:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:punbb:punbb:1.2.12:*:*:*:*:*:*:*