CVE-2006-5829 EXPLOIT
Patch early
A public exploit exists.
Description
Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) choosed_language parameter to (a) cp_dpage.php, (b) cp_news.php, (c) cp_forum_view.php, (d) cp_edit_user.php, (e) cp_newsletter.php, (f) cp_links.php, (g) cp_contact_us.php, (h) cp_login.php, and (i) cp_codice_fiscale.php in public/code/; (2) news_category parameter to public/code/cp_news.php; (3) nlmsg_nlcatid parameter to public/code/cp_newsletter.php; (4) links_category parameter to public/code/cp_links.php; (5) product_category_id parameter to public/code/cp_show_ec_products.php; (6) order_field parameter to public/code/cp_show_ec_products.php; (7) firstrow parameter to public/code/cp_users_online.php; and (8) orderdir parameter to public/code/cp_links_search.php.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 1.17% — more likely to be exploited than 67% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-11-10 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| aiocp | aiocp |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | AIOCP 1.3.x - 'cp_dpage.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_news.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_forum_view.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_edit_user.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_newsletter.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_links.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_contact_us.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_show_ec_products.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_login.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_users_online.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_codice_fiscale.php' SQL Injection | 2006-11-06 |
| exploit-db | AIOCP 1.3.x - 'cp_links_search.php' SQL Injection | 2006-11-06 |
References
- http://secunia.com/advisories/22719
- http://securityreason.com/securityalert/1839
- http://sourceforge.net/project/shownotes.php?release_id=478370
- http://www.securityfocus.com/archive/1/450701/100/0/threaded
- http://www.securityfocus.com/bid/20931
- http://www.vupen.com/english/advisories/2006/4378
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30051
- http://secunia.com/advisories/22719
- http://securityreason.com/securityalert/1839
- http://sourceforge.net/project/shownotes.php?release_id=478370
- http://www.securityfocus.com/archive/1/450701/100/0/threaded
- http://www.securityfocus.com/bid/20931
- http://www.vupen.com/english/advisories/2006/4378
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30051
→ the Explorer · watch your stack · NVD