CVE-2006-4244

SQL-Ledger 2.4.4-2.6.17 - Unauthenticated Session Fixation via Cookie-Parameter Matching

Title source: llm
STIX 2.1

Description

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/28671
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/19758
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/21689
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/444741/100/0/threaded
Exploit mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/445512
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/1472

Scores

EPSS 0.0181
EPSS Percentile 75.9%

Details

CWE
CWE-287
Status published
Products (31)
sql-ledger/sql-ledger 2.4.4
sql-ledger/sql-ledger 2.4.5
sql-ledger/sql-ledger 2.4.6
sql-ledger/sql-ledger 2.4.7
sql-ledger/sql-ledger 2.4.8
sql-ledger/sql-ledger 2.4.9
sql-ledger/sql-ledger 2.4.10
sql-ledger/sql-ledger 2.4.11
sql-ledger/sql-ledger 2.4.12
sql-ledger/sql-ledger 2.4.13
... and 21 more
Published Aug 31, 2006
Tracked Since Feb 18, 2026