« Volver al listado

CVE-2006-4592

Estado: ModificadaAlta (7.5)—

Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via ">" characters in the id parameter, which are not filtered by the protection mechanism.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

8pixel.net — Simple Blog

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-4592",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-09-06T22:04:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/21755",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1016793",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/28541",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/19848",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/3451",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/2296",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21755",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1016793",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/28541",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/19848",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/3451",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/2296",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via \">\" characters in the id parameter, which are not filtered by the protection mechanism."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de lista negra incompleta en default.asp en 8pixel.net Simple Blog 2.3 y anteriores permite a un atacante remoto dirigir ataques de inyección SQL a través de los caracteres \">\" en el parámetro id, lo cual no está filtrado por un mecanismo de protección."
    }
  ],
  "lastModified": "2026-06-16T22:29:24.680",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:8pixel.net:simple_blog:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93C72878-B103-4D23-83E2-AD084E9397B3"
            },
            {
              "criteria": "cpe:2.3:a:8pixel.net:simple_blog:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2E89355-BE7C-4E40-946C-83CECED23DB8"
            },
            {
              "criteria": "cpe:2.3:a:8pixel.net:simple_blog:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F8D5F63-A259-49B9-94E0-BBB4432AB63B"
            },
            {
              "criteria": "cpe:2.3:a:8pixel.net:simple_blog:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "907F1976-EA33-418C-AD70-9184C8BA8A0C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}