CVE-2006-6200

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Multiple SQL injection vulnerabilities in the (1) rate_article and (2) rate_complete functions in modules/News/index.php in the News module in Francisco Burzi PHP-Nuke 7.9 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the sid parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/23128Vendor Advisory
http://securityreason.com/securityalert/1935
http://securitytracker.com/id?1017282Vendor Advisory
http://www.neosecurityteam.net/index.php?action=advisories&id=30Patch
http://www.securityfocus.com/archive/1/452553/100/0/threaded
http://www.securityfocus.com/bid/21277Exploit, Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2006/4739
https://exchange.xforce.ibmcloud.com/vulnerabilities/30525
http://secunia.com/advisories/23128Vendor Advisory
http://securityreason.com/securityalert/1935
http://securitytracker.com/id?1017282Vendor Advisory
http://www.neosecurityteam.net/index.php?action=advisories&id=30Patch
http://www.securityfocus.com/archive/1/452553/100/0/threaded
http://www.securityfocus.com/bid/21277Exploit, Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2006/4739
https://exchange.xforce.ibmcloud.com/vulnerabilities/30525

Timeline

Published: Dec 1, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-62017.5Heap-based buffer overflow in Borland idsql32.dll 5.1.0.4, as used by RevilloC MailServer; 5.2.0.2 as used by Borland Developer Studio 2006;CVE-2006-62027.5PHP remote file inclusion vulnerability in modules/NukeAI/util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke, aka Program E is an AIML ch CVE-2006-62035.0Directory traversal vulnerability in startdown.php in the Flyspray ME 1.0.1 (com_flyspray) component for Mambo allows remote attackers to re CVE-2006-62047.5Multiple SQL injection vulnerabilities in Enthrallweb eHomes allow remote attackers to execute arbitrary SQL commands via the (1) cid parame CVE-2006-62056.8Multiple cross-site scripting (XSS) vulnerabilities in result.asp in Enthrallweb eHomes allow remote attackers to inject arbitrary web scrip CVE-2006-62067.5SQL injection vulnerability in item.asp in WarHound General Shopping Cart allows remote attackers to execute arbitrary SQL commands via the CVE-2006-62077.5SQL injection vulnerability in products.asp in Evolve shopping cart (aka Evolve Merchant) allows remote attackers to execute arbitrary SQL c CVE-2006-62087.5Multiple SQL injection vulnerabilities in Enthrallweb eClassifieds allow remote attackers to execute arbitrary SQL commands via the (1) AD_I CVE-2006-62097.5Multiple SQL injection vulnerabilities in MidiCart ASP Shopping Cart and ASP Plus Shopping Cart allow remote attackers to execute arbitrary CVE-2006-62107.5SQL injection vulnerability in listpics.asp in ASP ListPics 5.0 allows remote attackers to execute arbitrary SQL commands via the ID paramet CVE-2006-62116.8Multiple cross-site scripting (XSS) vulnerabilities in BirdBlog 1.4.0 allow remote attackers to inject arbitrary web script or HTML via the CVE-2006-62127.5PHP remote file inclusion vulnerability in centre.php in Site News (site_news) 2.00, and possibly earlier, allows remote attackers to execut