Vulnerabilities > CVE-2006-1534 - SQL Injection vulnerability in Null News

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
null-news
NVD
Published: 2006-03-30
Updated: 2018-10-18

Summary

Multiple SQL injection vulnerabilities in Null news allow remote attackers to execute arbitrary SQL commands via (1) the user_email parameter in (a) lostpass.php, and the (2) user_email and (3) user_username parameters in (b) sub.php and (c) unsub.php. Succesful exploitation of this vulnerability requires the "magic_quotes_gpc" parameter to be disabled.

Vulnerable Configurations

Part Description Count
Application
Null_News
1

References