CVE-2006-4244

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.

Published: Aug 31, 2006
Updated: Apr 13, 2023
CVE: CVE-2006-4244
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
sql-ledger / sql-ledger	2.6.16	2.6.16.x
sql-ledger / sql-ledger	2.4.5	2.4.5.x
sql-ledger / sql-ledger	2.6.6	2.6.6.x
sql-ledger / sql-ledger	2.6.11	2.6.11.x
sql-ledger / sql-ledger	2.4.7	2.4.7.x
sql-ledger / sql-ledger	2.6.1	2.6.1.x
sql-ledger / sql-ledger	2.6.15	2.6.15.x
sql-ledger / sql-ledger	2.4.8	2.4.8.x
sql-ledger / sql-ledger	2.6.9	2.6.9.x
sql-ledger / sql-ledger	2.6.0	2.6.0.x
sql-ledger / sql-ledger	2.6.12	2.6.12.x
sql-ledger / sql-ledger	2.6.3	2.6.3.x
sql-ledger / sql-ledger	2.4.9	2.4.9.x
sql-ledger / sql-ledger	2.6.17	2.6.17.x
sql-ledger / sql-ledger	2.4.4	2.4.4.x
sql-ledger / sql-ledger	2.6.14	2.6.14.x
sql-ledger / sql-ledger	2.4.6	2.4.6.x
sql-ledger / sql-ledger	2.4.10	2.4.10.x
sql-ledger / sql-ledger	2.4.13	2.4.13.x
sql-ledger / sql-ledger	2.6.4	2.6.4.x
sql-ledger / sql-ledger	2.4.16	2.4.16.x
sql-ledger / sql-ledger	2.6.7	2.6.7.x
sql-ledger / sql-ledger	2.4.14	2.4.14.x
sql-ledger / sql-ledger	2.4.15	2.4.15.x
sql-ledger / sql-ledger	2.4.12	2.4.12.x
sql-ledger / sql-ledger	2.6.2	2.6.2.x
sql-ledger / sql-ledger	2.4.11	2.4.11.x
sql-ledger / sql-ledger	2.6.10	2.6.10.x
sql-ledger / sql-ledger	2.6.8	2.6.8.x
sql-ledger / sql-ledger	2.6.5	2.6.5.x
sql-ledger / sql-ledger	2.6.13	2.6.13.x

Vulnerability Database

CVE-2006-4244