« Volver al listado

CVE-2006-3799

Estado: ModificadaAlta (7.5)—

DeluxeBB 1.07 and earlier allows remote attackers to bypass SQL injection protection mechanisms via the login variable and certain other variables, by using lowercase "union select" or possibly other statements that do not match the uppercase "UNION SELECT."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Deluxebb — Deluxebb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-3799",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-07-24T12:19:00.000",
  "references": [
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047989.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21116",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/1254",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/440435/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/19052",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2879",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047989.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/21116",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/1254",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/440435/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/19052",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2879",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "DeluxeBB 1.07 and earlier allows remote attackers to bypass SQL injection protection mechanisms via the login variable and certain other variables, by using lowercase \"union select\" or possibly other statements that do not match the uppercase \"UNION SELECT.\""
    },
    {
      "lang": "es",
      "value": "DeluxeBB 1.07 y versiones anteriores permite a atacantes remotos evitar mecanismos de protección de inyección de SQL mediante la variable login y otras variables concretas, usando en mínusculas \"union select\" ó posiblemente otras consultas que no coinciden con \"UNION SELECT\" en mayúsculas."
    }
  ],
  "lastModified": "2026-06-16T22:27:49.933",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:deluxebb:deluxebb:1.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A65D83C-FB89-46C8-8ABA-D9F66ACE8B88"
            },
            {
              "criteria": "cpe:2.3:a:deluxebb:deluxebb:1.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37F38906-2E8F-40E4-A03B-8121FDEF903C"
            },
            {
              "criteria": "cpe:2.3:a:deluxebb:deluxebb:1.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC51CF33-9B6A-40BE-B5A6-3596C02C48B5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}