Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2006-6095: ActiveNews Manager lets attackers run database commands

CVE-2006-6095 · published 19 years ago

Summary

The ActiveNews Manager web component can be tricked into running unwanted database queries when an attacker supplies specially crafted values to certain web pages. This could let a remote user view, change, or delete data stored by the application. Apply the vendor's patch or update to a secured version as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dotnetindex	active_news_manager	All versions `cpe:2.3:a:dotnetindex:active_news_manager::::::::`

Original advisory text

Multiple SQL injection vulnerabilities in ActiveNews Manager allow remote attackers to execute arbitrary SQL commands via the (1) articleID parameter to activenews_view.asp or the (2) page parameter to default.asp. NOTE: the activeNews_categories.asp and activeNews_comments.asp vectors are already covered by CVE-2006-6094.

References

http://marc.info/?l=bugtraq&m=116387481223790&w=2 Mailing List
http://www.aria-security.com/forum/showthread.php?t=33 Broken Link
http://www.osvdb.org/31568 Broken Link
http://www.osvdb.org/31569 Broken Link
http://www.securityfocus.com/bid/21167 Exploit Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/30352

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published24 Nov 2006

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2006-6095 · NVD

Track software like this

Free during beta