CVE-2006-2214 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 2.7% (pctl 85)
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid parameter in (1) top.php and (2) member.php. NOTE: this issue has also been reported to affect 1.7.2.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 2.67% — more likely to be exploited than 85% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-05-05 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| 4images | image gallery management system |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | 4Images 1.7.1 - 'top.php?sessionid' SQL Injection | 2006-04-29 |
| exploit-db | 4Images 1.7.1 - 'member.php?sessionid' SQL Injection | 2006-04-29 |
References
- http://archives.neohapsis.com/archives/bugtraq/2006-05/0012.html
- http://secunia.com/advisories/19908
- http://www.osvdb.org/25153
- http://www.osvdb.org/25154
- http://www.securityfocus.com/bid/17748
- http://www.vupen.com/english/advisories/2006/1604
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26184
- http://archives.neohapsis.com/archives/bugtraq/2006-05/0012.html
- http://secunia.com/advisories/19908
- http://www.osvdb.org/25153
- http://www.osvdb.org/25154
- http://www.securityfocus.com/bid/17748
- http://www.vupen.com/english/advisories/2006/1604
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26184
→ the Explorer · watch your stack · NVD