« Volver al listado

CVE-2006-6233

Estado: ModificadaAlta (7.5)—

SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewdownloaddetails operation. NOTE: this issue might have been in the viewdownloaddetails function in dl-downloaddetails.php, but PostNuke 0.764 does not appear to have this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Postnuke Software Foundation — Postnuke

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-6233",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-12-02T11:28:00.000",
  "references": [
    {
      "url": "http://securityreason.com/securityalert/1952",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/437832/100/200/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27501",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/1952",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/437832/100/200/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27501",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewdownloaddetails operation. NOTE: this issue might have been in the viewdownloaddetails function in dl-downloaddetails.php, but PostNuke 0.764 does not appear to have this issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en el módulo Downloads para versiones desconocidas de PostNuke permite a un atacante remoto ejecutar comandos SQL de su elección a través del parámetro lid en una operación viewdownloaddetails. NOTA: este asunto pudo haber estado en la función viewdownloaddetails en dl-downloaddetails.php, pero PostNuke 0.764 no parece tener este asunto."
    }
  ],
  "lastModified": "2026-06-16T22:32:43.710",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE44C155-EDF6-4F4C-81A5-201BD561843F"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58BE1A1F-0A0C-4965-9AC2-6E547B0EE582"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B73A09B4-83C0-47DE-A199-F2A490527263"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.760_rc2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3700514A-DB69-49F4-AB13-B9DAEB93F303"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.760_rc3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B720E0CD-7975-4D56-9F09-371E742443C7"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.760_rc4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04899497-8B17-4428-9E60-EF8FDEA5F966"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.761:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C55DA346-A7A0-466F-90D7-CC1E7C2E9EFD"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.761a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4EB4E7B-29AF-479F-AF9C-3AE84FBDB603"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.762:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11B4716F-F173-4026-87C2-A3A97DA0CB2A"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.763:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9EB8EA0A-1A5C-4B3D-9697-762FF044BF34"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}