CVE-2006-0602

phphg Guestbook 1.2 - SQL Injection via Username or ID Parameter

Title source: llm

Description

Multiple SQL injection vulnerabilities in Hinton Design phphg Guestbook 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to check.php or the id parameter to (2) admin/edit_smilie.php, (3) admin/add_theme.php, (4) admin/ban_ip.php, (5) admin/add_lang.php, or (6) admin/edit_filter.php.

References (6)

Core 6

Core References

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/0480

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/16541

Exploit vdb-entry x_refsource_sectrack

http://securitytracker.com/id?1015620

Exploit x_refsource_misc

http://evuln.com/vulns/58/summary.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/18758

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/424740/100/0/threaded

Scores

EPSS 0.0223

EPSS Percentile 81.0%

Details

CWE

CWE-89

Status published

Products (1)

hinton_design/phphg_guestbook 1.2

Published Feb 08, 2006

Tracked Since Feb 18, 2026