Unscored severity · published Jul 7, 2006
CVE-2006-3430
SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows…
–
CVSS
1.8%
EPSS
No
On KEV
Description
SQL injection vulnerability in checkprofile.asp in (1) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (2) Novell ZENworks 6.2 SR1 and earlier, allows remote attackers to execute arbitrary SQL commands via the agentid parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Patchlink Update Server · Lumension
6.1; 6.2.0.181; 6.2.0.189 · source: NVD
ZE
Zenworks · Novell
through 6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3430
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3430
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/047495.html
Vendor Advisory
http://secunia.com/advisories/20876
Vendor Advisory
http://secunia.com/advisories/20878
securityreason.com
http://securityreason.com/securityalert/1200
securitytracker.com
http://securitytracker.com/id?1016405
www.securityfocus.com
http://www.securityfocus.com/archive/1/438710/100/0/threaded
More from Patchlink Update Server
–
CVE-2006-3425
FastPatch for (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1, and (b) Novell ZENworks 6.2 SR1 and earlier, does not require authentication for…
–
CVE-2006-3426
Directory traversal vulnerability in (a) PatchLink Update Server (PLUS) before 6.1 P1 and 6.2.x before 6.2 SR1 P1 and (b) Novell ZENworks 6.2 SR1 and earlier allows remote…