CVE-2006-6092 - Vulnerability Details - OpenCVE

Multiple SQL injection vulnerabilities in vehiclelistings.asp in 20/20 Auto Gallery allow remote attackers to execute arbitrary SQL commands via the (1) vehicleID, (2) categoryID_list, (3) sale_type, (4) stock_number, (5) manufacturer, (6) model, (7) vehicleID, (8) year, (9) vin, and (10) listing_price parameters.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
20 20 Applications	20 20 Auto Gallery

Configuration 1 [-]

cpe:2.3:a:20_20_applications:20_20_auto_gallery:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://s-a-p.ca/index.php?page=OurAdvisories&id=38
http://secunia.com/advisories/22974
http://securityreason.com/securityalert/1916
http://www.securityfocus.com/archive/1/451947/100/100/threaded
http://www.securityfocus.com/bid/21154
http://www.vupen.com/english/advisories/2006/4601
https://exchange.xforce.ibmcloud.com/vulnerabilities/30400

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2006-11-24T18:00:00

Updated: 2024-08-07T20:12:31.644Z

Reserved: 2006-11-24T00:00:00

Link: CVE-2006-6092

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2006-11-24T18:07:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2006-6092

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2006-11-17T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in vehiclelistings.asp in 20/20 Auto Gallery allow remote attackers to execute arbitrary SQL commands via the (1) vehicleID, (2) categoryID_list, (3) sale_type, (4) stock_number, (5) manufacturer, (6) model, (7) vehicleID, (8) year, (9) vin, and (10) listing_price parameters."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-17T20:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://s-a-p.ca/index.php?page=OurAdvisories&id=38"}, {"name": "22974", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/22974"}, {"name": "20061117 20/20 auto gallery [ multiples injection sql ]", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/451947/100/100/threaded"}, {"name": "ADV-2006-4601", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2006/4601"}, {"name": "2020autogallery-vehicle-sql-injection(30400)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30400"}, {"name": "1916", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/1916"}, {"name": "21154", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/21154"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2006-6092", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple SQL injection vulnerabilities in vehiclelistings.asp in 20/20 Auto Gallery allow remote attackers to execute arbitrary SQL commands via the (1) vehicleID, (2) categoryID_list, (3) sale_type, (4) stock_number, (5) manufacturer, (6) model, (7) vehicleID, (8) year, (9) vin, and (10) listing_price parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://s-a-p.ca/index.php?page=OurAdvisories&id=38", "refsource": "MISC", "url": "http://s-a-p.ca/index.php?page=OurAdvisories&id=38"}, {"name": "22974", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/22974"}, {"name": "20061117 20/20 auto gallery [ multiples injection sql ]", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/451947/100/100/threaded"}, {"name": "ADV-2006-4601", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2006/4601"}, {"name": "2020autogallery-vehicle-sql-injection(30400)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30400"}, {"name": "1916", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/1916"}, {"name": "21154", "refsource": "BID", "url": "http://www.securityfocus.com/bid/21154"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T20:12:31.644Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://s-a-p.ca/index.php?page=OurAdvisories&id=38"}, {"name": "22974", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/22974"}, {"name": "20061117 20/20 auto gallery [ multiples injection sql ]", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/451947/100/100/threaded"}, {"name": "ADV-2006-4601", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2006/4601"}, {"name": "2020autogallery-vehicle-sql-injection(30400)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30400"}, {"name": "1916", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/1916"}, {"name": "21154", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/21154"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2006-6092", "datePublished": "2006-11-24T18:00:00", "dateReserved": "2006-11-24T00:00:00", "dateUpdated": "2024-08-07T20:12:31.644Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:20_20_applications:20_20_auto_gallery:*:*:*:*:*:*:*:*", "matchCriteriaId": "D253F0B4-E4D3-4272-A639-2A956C689472", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple SQL injection vulnerabilities in vehiclelistings.asp in 20/20 Auto Gallery allow remote attackers to execute arbitrary SQL commands via the (1) vehicleID, (2) categoryID_list, (3) sale_type, (4) stock_number, (5) manufacturer, (6) model, (7) vehicleID, (8) year, (9) vin, and (10) listing_price parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en vehiclelistings.asp en 20/20 Auto Gallery permite a un atacante remoto ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de los par\u00e1metros (1) vehicleID, (2) categoryID_list, (3) sale_type, (4) stock_number, (5) manufacturer, (6) model, (7) vehicleID, (8) year, (9) vin, y (10) listing_price."}], "id": "CVE-2006-6092", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": true, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2006-11-24T18:07:00.000", "references": [{"source": "cve@mitre.org", "tags": ["URL Repurposed"], "url": "http://s-a-p.ca/index.php?page=OurAdvisories&id=38"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/22974"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/1916"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/451947/100/100/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/21154"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2006/4601"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30400"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["URL Repurposed"], "url": "http://s-a-p.ca/index.php?page=OurAdvisories&id=38"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/22974"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/1916"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/451947/100/100/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/21154"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2006/4601"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30400"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}