CVE-2006-6233

SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewdownloaddetails operation. NOTE: this issue might have been in the viewdownloaddetails function in dl-downloaddetails.php, but PostNuke 0.764 does not appear to have this issue.

Published: Dec 2, 2006
Updated: Apr 13, 2023
CVE: CVE-2006-6233
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
postnuke_software_foundation / postnuke	0.761	0.761.x
postnuke_software_foundation / postnuke	0.760_rc4	0.760_rc4.x
postnuke_software_foundation / postnuke	0.760_rc3	0.760_rc3.x
postnuke_software_foundation / postnuke	0.760_rc2	0.760_rc2.x
postnuke_software_foundation / postnuke	0.762	0.762.x
postnuke_software_foundation / postnuke	0.763	0.763.x
postnuke_software_foundation / postnuke	0.76_rc4b	0.76_rc4b.x
postnuke_software_foundation / postnuke	0.76_rc4	0.76_rc4.x
postnuke_software_foundation / postnuke	0.761a	0.761a.x
postnuke_software_foundation / postnuke	0.76_rc4a	0.76_rc4a.x

Vulnerability Database

289,697

CVE-2006-6233