$ cve CVE-2006-6927 JSON

CVE-2006-6927 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 1.2% (pctl 68)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in Rialto 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the uname (username) and (2) pword (passwd) fields in (a) admin/default.asp; the (3) ID parameter to (b) listfull.asp or (c) printmain.asp; the (4) cat parameter to (d) listmain.asp, (e) searchoption.asp, or (f) searchmain.asp; the (5) Keyword parameter to (g) searchkey.asp; the (6) area parameter to searchmain.asp or searchoption.asp; the (7) searchin parameter to searchkey.asp; or the (8) cost1, (9) cost2, (10) acreage1, or (11) squarefeet1 parameters to searchoption.asp. NOTE: some of these details are obtained from third party information.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	1.24% — more likely to be exploited than 68% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-01-13
Last modified	2026-06-16

Affected (1)

Vendor	Product
grandora	rialto

Public exploits

Source	Title	Date
exploit-db	Grandora Rialto 1.6 - '/admin/default.asp' Multiple SQL Injections	2006-11-20
exploit-db	Grandora Rialto 1.6 - 'listfull.asp?ID' SQL Injection	2006-11-20
exploit-db	Grandora Rialto 1.6 - 'listmain.asp?cat' SQL Injection	2006-11-20
exploit-db	Grandora Rialto 1.6 - 'printmain.asp?ID' SQL Injection	2006-11-20
exploit-db	Grandora Rialto 1.6 - 'searchkey.asp' Multiple SQL Injections	2006-11-20
exploit-db	Grandora Rialto 1.6 - 'searchmain.asp' Multiple SQL Injections	2006-11-20
exploit-db	Grandora Rialto 1.6 - 'searchoption.asp' Multiple SQL Injections	2006-11-20

References

→ the Explorer · watch your stack · NVD