Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2006-3271: Softbiz Dating lets attackers run database commands

CVE-2006-3271 · published 20 years ago

Summary

The Softbiz Dating 1.0 web script can be tricked into running unwanted database queries through several input fields, such as country, sort_by, browse, and others. This could let an attacker view, change, or delete data stored by the site. Update to a patched version or apply input validation to block these malicious requests.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
softbizscripts	dating_script	1.0 `cpe:2.3:a:softbizscripts:dating_script:1.0:::::::*`

Original advisory text

Multiple SQL injection vulnerabilities in Softbiz Dating 1.0 allow remote attackers to execute SQL commands via the (1) country and (2) sort_by parameters in (a) search_results.php; (3) browse parameter in (b) featured_photos.php; (4) cid parameter in (c) products.php, (d) index.php, and (e) news_desc.php.

References

http://secunia.com/advisories/20802 Exploit Vendor Advisory
http://securityreason.com/securityalert/1163 Third Party Advisory
http://www.securityfocus.com/archive/1/438245/100/0/threaded Broken Link
http://www.securityfocus.com/bid/18605 Exploit
http://www.vupen.com/english/advisories/2006/2512 Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/27383 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Timeline

Published28 Jun 2006

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2006-3271 · NVD

Track software like this

Free during beta