CVE-2006-6066
Dragon Calendar / Events Listing 2.x - SQL Injection via Multiple Parameters
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2006-6066. PoCs published by Benjamin Moss.
AI-analyzed exploit summary The provided text describes a SQL injection vulnerability in Dragon Event Listing, where the 'VenueID' parameter in 'venue_detail.asp' is not properly sanitized. It includes a basic example URL for exploitation but lacks actual exploit code.
Description
Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) admin_login.asp, the (3) ID parameter to (b) event_searchdetail.asp, or the (4) VenueID parameter to (c) venue_detail.asp.
Exploits (3)
The provided text describes a SQL injection vulnerability in Dragon Event Listing, where the 'VenueID' parameter in 'venue_detail.asp' is not properly sanitized. It includes a basic example URL for exploitation but lacks actual exploit code.
The provided text describes a SQL injection vulnerability in Dragon Event Listing, where the 'ID' parameter in 'event_searchdetail.asp' is not properly sanitized. It includes a basic example URL for exploitation but lacks actual exploit code.
The provided text describes SQL injection vulnerabilities in Dragon Event Listing due to improper input sanitization. It includes example payloads for username and password fields but lacks executable exploit code.