CVE-2006-2268

Flexcustomer - SQL Injection

Title source: rule
STIX 2.1

Description

SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably involving the (1) checkuser and (2) checkpass parameters to (a) admin/index.php, and (3) username and (4) password parameters to (b) index.php. NOTE: it was later reported that 0.0.6 is also affected.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Osirys · textwebappsphp
https://www.exploit-db.com/exploits/7622

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/47651
Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/17864
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/26323
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/1690
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/25342
Exploit third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/858
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/433125/100/0/threaded
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/20016
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/25343
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/7622

Scores

EPSS 0.0112
EPSS Percentile 78.4%

Details

CWE
CWE-89
Status published
Products (2)
flexcustomer/flexcustomer 0.0.1
flexcustomer/flexcustomer 0.0.4
Published May 09, 2006
Tracked Since Feb 18, 2026