CVE-2006-2065
Last modified
CVE-2006-2065 is a vulnerability of currently unknown severity. SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal sequences into the database, which are then processed by the thissurvey['language'] variable.. EPSS estimates a 1.71% chance of exploitation in the next 30 days.
Description
SQL injection vulnerability in save.php in PHPSurveyor 0.995 and earlier allows remote attackers to execute arbitrary SQL commands via the surveyid cookie. NOTE: this issue could be leveraged to execute arbitrary PHP code, as demonstrated by inserting directory traversal sequences into the database, which are then processed by the thissurvey['language'] variable.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Phpsurveyor | Phpsurveyor | 0.96_beta |
| Phpsurveyor | Phpsurveyor | 0.97_beta |
| Phpsurveyor | Phpsurveyor | 0.98_beta |
| Phpsurveyor | Phpsurveyor | 0.98_stable |
| Phpsurveyor | Phpsurveyor | 0.99 |
| Phpsurveyor | Phpsurveyor | 0.991 |
| Phpsurveyor | Phpsurveyor | 0.992 |
| Phpsurveyor | Phpsurveyor | 0.993 |
| Phpsurveyor | Phpsurveyor | 0.995 |
References
- http://secunia.com/advisories/19761Patch, Vendor Advisory
- http://secunia.com/advisories/19761Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-2065?
How severe is CVE-2006-2065?
How do I fix CVE-2006-2065?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-2059action_public/search.php in Invision Power Board (IPB) 2.1.x…
- CVE-2006-2060Directory traversal vulnerability in action_admin/paysubscri…
- CVE-2006-2061SQL injection vulnerability in lib/func_taskmanager.php in I…
- CVE-2006-2062Multiple SQL injection vulnerabilities in Leadhound Full and…
- CVE-2006-2063Multiple cross-site scripting (XSS) vulnerabilities in Leadh…
- CVE-2006-2064Unspecified vulnerability in the libpkcs11 library in Sun So…
- CVE-2006-2066Multiple cross-site scripting (XSS) vulnerabilities pm_popup…
- CVE-2006-2067SQL injection vulnerability in vb_board_functions.php in MKP…
- CVE-2006-2068Unspecified vulnerability in Hitachi JP1 products allow remo…
- CVE-2006-2069The recursor in PowerDNS before 3.0.1 allows remote attacker…
- CVE-2006-2070Cross-site scripting (XSS) vulnerability in member.php in De…
- CVE-2006-2071Linux kernel 2.4.x and 2.6.x up to 2.6.16 allows local users…
Are you affected by CVE-2006-2065?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST