Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

IdeoContent Manager index.php can run unwanted database commands

CVE-2006-0464 · published 20 years ago
Summary

The index.php page in IdeoContent Manager does not check certain input fields, so a remote user could send specially crafted requests that make the system run its own database commands. This could let an attacker view, change, or delete your stored information. Apply any available updates, and make sure all input is properly validated or filtered to prevent this.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ideosoft_design ideocontent_manager All versions
cpe:2.3:a:ideosoft_design:ideocontent_manager:*:*:*:*:*:*:*:*
Original advisory text
Multiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter.
Multiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Timeline
Published27 Jan 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-0464 · NVD
Track software like this
Free during beta