Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Kinesis Interactive Cinema System lets attackers run database commands

CVE-2006-5450 · published 20 years ago
Summary

The cinema system’s web page accepts user names and passwords without checking them properly, so a remote attacker can send specially crafted input that runs their own commands on the system’s database. This could let the attacker view, change, or delete data. Apply any available updates from the vendor and ensure that all input is validated before it is processed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
kinesis kinesis_interactive_cinema_system All versions
cpe:2.3:a:kinesis:kinesis_interactive_cinema_system:*:*:*:*:*:*:*:*
Original advisory text
SQL injection vulnerability in index.asp in Kinesis Interactive Cinema System (KICS) CMS allows remote attackers to execute arbitrary SQL commands via the (1) txtUsername (user) or (2) txtPassword ...
SQL injection vulnerability in index.asp in Kinesis Interactive Cinema System (KICS) CMS allows remote attackers to execute arbitrary SQL commands via the (1) txtUsername (user) or (2) txtPassword (pass) parameters.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Timeline
Published23 Oct 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-5450 · NVD
Track software like this
Free during beta