CVE-2006-6067
20/20 DataShed - SQL Injection via itemID, peopleID, or sort_order Parameters
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-6067. PoCs published by laurent gaffie.
AI-analyzed exploit summary The provided text describes SQL injection vulnerabilities in 20/20 DataShed version 1.0, where user-supplied input in the 'peopleID' and 'sort_order' parameters is not properly sanitized. Exploitation could lead to database manipulation or access to sensitive data.
Description
Multiple SQL injection vulnerabilities in 20/20 DataShed (aka Real Estate Listing System) allow remote attackers to execute arbitrary SQL commands via the (1) itemID parameter to (a) f-email.asp, or the (2) peopleID and (2) sort_order parameters to (b) listings.asp, different vectors than CVE-2006-5955.
Exploits (2)
The provided text describes SQL injection vulnerabilities in 20/20 DataShed version 1.0, where user-supplied input in the 'peopleID' and 'sort_order' parameters is not properly sanitized. Exploitation could lead to database manipulation or access to sensitive data.
The provided text describes a SQL injection vulnerability in 20/20 DataShed version 1.0, where the 'strPeopleID' and 'itemID' parameters in 'f-email.asp' are not properly sanitized. It includes a basic example URL to demonstrate the vulnerability but lacks executable exploit code.