Unscored severity · published Mar 19, 2006
CVE-2006-1289
Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3)…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3) team, (4) level, (5) status, (6) teamname, and (7) teamlead parameters in (a) auth.php; the (8) username, (9) action, and (10) filter parameters in (b) authuser.php; the (11) username parameter in (c) utils.php; the (12) id and (13) date parameters in (d) traffic.php; the (14) username parameter in (e) userstatistics.php; and the (15) USERNAME and (16) PASSWORD parameters in a cookie to (f) chgpwd.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Milkeyway Captive Portal · Milkeyway
0.1; 0.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1289
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1289
secunia.com
http://secunia.com/advisories/19258
securitytracker.com
http://securitytracker.com/id?1015778
www.osvdb.org
http://www.osvdb.org/23925
www.osvdb.org
http://www.osvdb.org/23927
www.osvdb.org
http://www.osvdb.org/23928
www.osvdb.org
http://www.osvdb.org/23929
More from Milkeyway Captive Portal
–
CVE-2006-1290
Multiple cross-site scripting (XSS) vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) ipAddress,…