CVE-2006-3249
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2006-3249
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error." While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Phorum search.php SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
** 有争议 ** Phorum 5.1.14及更早版本的search.php中的SQL注入漏洞，可让远程攻击者通过page参数执行任意SQL命令。注意：供应商对此报告有争议，声称"如果对搜索URL的page参数使用非正整数或非整数，搜索查询将会对LIMIT子句使用负数。这会导致查询中断，不显示任何结果。但这不是sql注入错误"。然而原始报告的研究者信息不太准确，截至2006年7月3日，CVE没有获得关于此问题的更多信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2006-3249
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2006-3249
请登录查看更多情报信息。
- http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#previewx_refsource_MISC
- http://www.phorum.org/phorum5/read.php?14%2C114358x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2006-3249
Same Patch Batch · n/a · 2006-06-27 · 46 CVEs total
| CVE-2006-3259 | e107 Search.PHP 多个跨站脚本漏洞 | |
| CVE-2006-3262 | Mambo Weblinks模块 SQL注入漏洞 | |
| CVE-2006-3264 | Namo DeepSearch Mclient.CGI 跨站脚本攻击漏洞 | |
| CVE-2006-3267 | Infinite Core Technologies INDEX.PHP SQL注入漏洞 | |
| CVE-2006-1469 | Apple Mac OS X ImageIO 栈缓冲区溢出漏洞 | |
| CVE-2006-1470 | Apple Mac OS X OpenLDAP 拒绝服务漏洞 | |
| CVE-2006-1471 | Apple Mac OS X CF_syslog函数 格式串漏洞 | |
| CVE-2006-0456 | Linux Kernel strnlen_user 拒绝服务漏洞 | |
| CVE-2006-3266 | Bee-hive 多个远程文件包含漏洞 | |
| CVE-2006-3260 | vlbook index.php 跨站脚本攻击(XSS)漏洞 | |
| CVE-2006-3261 | Trend Micro Control Manager 访问日志 跨站脚本攻击漏洞 | |
| CVE-2006-3258 | BNBT TrinEdit/EasyTracker index.html 多个跨站脚本攻击(XSS)漏洞 | |
| CVE-2006-3223 | ITM/eAV/ePP r8 格式化字符串漏洞 | |
| CVE-2006-1468 | Apple Mac OS X AFP服务 信息泄露漏洞 | |
| CVE-2006-3257 | Claroline 多个未明跨站脚本攻击漏洞 | |
| CVE-2006-3256 | Woltlab Burning Board report.php SQL注入漏洞 | |
| CVE-2006-3255 | Woltlab Burning Board showmods.php SQL注入漏洞 | |
| CVE-2006-3254 | Woltlab Burning Board newthread.php SQL注入漏洞 | |
| CVE-2006-3253 | Vbulletin Member.PHP 跨站脚本漏洞 | |
| CVE-2006-2200 | MiMMS 媒体流处理 远程栈溢出漏洞 |
Showing top 20 of 46 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2006-3249
No comments yet