CVE-2006-0897

SQL injection vulnerability in VCS Virtual Program Management Intranet (VPMi) Enterprise 3.3 allows remote attackers to execute arbitrary SQL commands via the UpdateID0 parameter to Service_Requests.asp. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: the vendor has disputed this issue, saying that "[we] have a behind the scenes complex state management system that uses a combination of keys placed in JavaScript and Session State (server side) that protects against the type of SQL injection you describe. We have tested for many of the cases and have not found it to be an issue." Further investigation suggests that the original researcher might have triggered errors using invalid field values, which is not proof of SQL injection; however, the vendor did not receive a response from the original researcher

• CWE-89

• http://secunia.com/advisories/18842Vendor Advisory
• http://www.attrition.org/pipermail/vim/2006-March/000598.html
• http://www.attrition.org/pipermail/vim/2006-March/000599.html
• http://www.osvdb.org/23479
• http://www.securityfocus.com/bid/16798
• http://www.vupen.com/english/advisories/2006/0725Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24885
• http://secunia.com/advisories/18842Vendor Advisory
• http://www.attrition.org/pipermail/vim/2006-March/000598.html
• http://www.attrition.org/pipermail/vim/2006-March/000599.html
• http://www.osvdb.org/23479
• http://www.securityfocus.com/bid/16798
• http://www.vupen.com/english/advisories/2006/0725Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24885

Published

Feb 25, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-0891Multiple directory traversal vulnerabilities in NOCC Webmail…
• CVE-2006-0892NOCC Webmail 1.0 stores e-mail attachments in temporary file…
• CVE-2006-0893NOCC Webmail 1.0 allows remote attackers to obtain sensitive…
• CVE-2006-0894Multiple cross-site scripting (XSS) vulnerabilities in NOCC …
• CVE-2006-0895NOCC Webmail 1.0 allows remote attackers to obtain the insta…
• CVE-2006-0896Cross-site scripting (XSS) vulnerability in Sources/Register…
• CVE-2006-0898Crypt::CBC Perl module 2.16 and earlier, when running in Ran…
• CVE-2006-0899Directory traversal vulnerability in index.php in 4Images 1.…
• CVE-2006-0900nfsd in FreeBSD 6.0 kernel allows remote attackers to cause …
• CVE-2006-0901Unspecified vulnerability in the hsfs filesystem in Solaris …
• CVE-2006-0903MySQL 5.0.18 and earlier allows local users to bypass loggin…
• CVE-2006-0904Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…