« Volver al listado

CVE-2006-3828

Estado: ModificadaMedia (6.5)—

Incomplete blacklist vulnerability in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote authenticated administrators to bypass SQL injection protection mechanisms by using commas, quote characters, pound sign (#) characters, "UNION," and "SELECT," which are not filtered by the product, which only checks for "insert," "delete," "update," and "replace."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Kailash Nadh — Boastmachine

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-3828",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-07-25T13:22:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/21066",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/1252",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1016515",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.acid-root.new.fr/advisories/boastmachine.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/440306/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2849",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21066",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/1252",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1016515",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.acid-root.new.fr/advisories/boastmachine.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/440306/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2849",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete blacklist vulnerability in Kailash Nadh boastMachine (formerly bMachine) 3.1 and earlier allows remote authenticated administrators to bypass SQL injection protection mechanisms by using commas, quote characters, pound sign (#) characters, \"UNION,\" and \"SELECT,\" which are not filtered by the product, which only checks for \"insert,\" \"delete,\" \"update,\" and \"replace.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de lista negra incompleta en Kailash Nadh boastMachine (formerly bMachine) 3.1 y anteriores permite a administradores remotos validados evitar los mecanismos de protección de inyección SQL con el uso de comas, caractéres de cuota, los caracteres almohadillas (#), \"UNION,\" y \"SELECT,\" los cuales no son filtrados por el producto, que solo valida para \"insert,\" \"delete,\" \"update,\" y\"replace.\""
    }
  ],
  "lastModified": "2026-06-16T22:27:54.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kailash_nadh:boastmachine:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B19759CD-3F3D-4A96-8DD0-828BA628427D"
            },
            {
              "criteria": "cpe:2.3:a:kailash_nadh:boastmachine:2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FD75997-6BFC-4161-A12A-8AB03FBDB562"
            },
            {
              "criteria": "cpe:2.3:a:kailash_nadh:boastmachine:2.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AC1D5AE-1D9C-416A-8A34-61931C810478"
            },
            {
              "criteria": "cpe:2.3:a:kailash_nadh:boastmachine:2.9b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "73D3FA6A-5221-4607-961F-075A78EC6BEA"
            },
            {
              "criteria": "cpe:2.3:a:kailash_nadh:boastmachine:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "621CCF40-F2DD-4F07-9F8B-37053AB04293"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}