CVE-2006-1278

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.

• CWE-89

• http://evuln.com/vulns/95/summary.htmlExploit
• http://osvdb.org/47017
• http://osvdb.org/47018
• http://secunia.com/advisories/19224Vendor Advisory
• http://secunia.com/advisories/31063Vendor Advisory
• http://securityreason.com/securityalert/619Exploit
• http://securitytracker.com/id?1015826Exploit
• http://www.attrition.org/pipermail/vim/2009-August/002246.html
• http://www.osvdb.org/23851Exploit
• http://www.osvdb.org/23852
• http://www.osvdb.org/23853
• http://www.osvdb.org/23854
• http://www.osvdb.org/23855
• http://www.osvdb.org/23856
• http://www.osvdb.org/23857
• http://www.osvdb.org/23858
• http://www.osvdb.org/23859
• http://www.osvdb.org/23860
• http://www.osvdb.org/23861
• http://www.osvdb.org/23862
• http://www.osvdb.org/23863
• http://www.osvdb.org/23864
• http://www.osvdb.org/24106
• http://www.securityfocus.com/archive/1/428659/100/0/threaded
• http://www.securityfocus.com/bid/17090
• http://www.securityfocus.com/bid/30182Exploit
• http://www.vupen.com/english/advisories/2006/0943Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25183
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43718
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43724
• https://www.exploit-db.com/exploits/6040
• http://evuln.com/vulns/95/summary.htmlExploit
• http://osvdb.org/47017
• http://osvdb.org/47018
• http://secunia.com/advisories/19224Vendor Advisory
• http://secunia.com/advisories/31063Vendor Advisory
• http://securityreason.com/securityalert/619Exploit
• http://securitytracker.com/id?1015826Exploit
• http://www.attrition.org/pipermail/vim/2009-August/002246.html
• http://www.osvdb.org/23851Exploit
• http://www.osvdb.org/23852
• http://www.osvdb.org/23853
• http://www.osvdb.org/23854
• http://www.osvdb.org/23855
• http://www.osvdb.org/23856
• http://www.osvdb.org/23857
• http://www.osvdb.org/23858
• http://www.osvdb.org/23859
• http://www.osvdb.org/23860
• http://www.osvdb.org/23861
• http://www.osvdb.org/23862
• http://www.osvdb.org/23863
• http://www.osvdb.org/23864
• http://www.osvdb.org/24106
• http://www.securityfocus.com/archive/1/428659/100/0/threaded
• http://www.securityfocus.com/bid/17090
• http://www.securityfocus.com/bid/30182Exploit
• http://www.vupen.com/english/advisories/2006/0943Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25183
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43718
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43724
• https://www.exploit-db.com/exploits/6040

Published

Mar 19, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1272Multiple cross-site scripting (XSS) vulnerabilities in membe…
• CVE-2006-1273Mozilla Firefox 1.0.7 and 1.5.0.1 allows remote attackers to…
• CVE-2006-1274Classic Planer in AntiVir PersonalEdition Classic 7 does not…
• CVE-2006-1275GGZ Gaming Zone 0.0.12 allows remote attackers to cause a de…
• CVE-2006-1276admin.php in Himpfen Consulting Company PHP SimpleNEWS 1.0.0…
• CVE-2006-1277Cross-site scripting (XSS) vulnerability in signup.php in @1…
• CVE-2006-1279CGI::Session 4.03-1 allows local users to overwrite arbitrar…
• CVE-2006-1280CGI::Session 4.03-1 does not set proper permissions on tempo…
• CVE-2006-1281Cross-site scripting (XSS) vulnerability in member.php in My…
• CVE-2006-1282CRLF injection vulnerability in inc/function.php in MyBullet…
• CVE-2006-1283opiepasswd in One-Time Passwords in Everything (OPIE) in Fre…
• CVE-2006-1284The installation of SQLAnywhere in Symantec Ghost 8.0 and 8.…