CVE-2006-1278

Published: Mar 19, 2006Modified: Apr 16, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to (1) functions.php and (2) user.php in the libs directory, (3) edit.php and (4) delete.php in control/files/, (5) edit.php and (6) delete.php in control/users/, (7) edit.php, (8) access.php, and (9) in control/folders/, (10) access.php and (11) delete.php in control/groups/, (12) confirm.php, and (13) download.php; (14) the email parameter in password.php, and (15) the id parameter in folder.php. NOTE: it was later reported that vectors 12 and 13 also affect @1 File Store PRO 3.2.

Affected (1)

Products: Upoint: @1 File Store

Upoint

1 product

@1 File Store

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Upoint @1 File Store	Version 2006.03.07

Related CWEs

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (62)

http://evuln.com/vulns/95/summary.html

Source: cve@mitre.org

Exploit

http://osvdb.org/47017

Source: cve@mitre.org

http://osvdb.org/47018

Source: cve@mitre.org

http://secunia.com/advisories/19224

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/31063

Source: cve@mitre.org

Vendor Advisory

http://securityreason.com/securityalert/619

Source: cve@mitre.org

Exploit

http://securitytracker.com/id?1015826

Source: cve@mitre.org

Exploit

http://www.attrition.org/pipermail/vim/2009-August/002246.html

Source: cve@mitre.org

http://www.osvdb.org/23851

Source: cve@mitre.org

Exploit

http://www.osvdb.org/23852

Source: cve@mitre.org

http://www.osvdb.org/23853

Source: cve@mitre.org

http://www.osvdb.org/23854

Source: cve@mitre.org

http://www.osvdb.org/23855

Source: cve@mitre.org

http://www.osvdb.org/23856

Source: cve@mitre.org

http://www.osvdb.org/23857

Source: cve@mitre.org

http://www.osvdb.org/23858

Source: cve@mitre.org

http://www.osvdb.org/23859

Source: cve@mitre.org

http://www.osvdb.org/23860

Source: cve@mitre.org

http://www.osvdb.org/23861

Source: cve@mitre.org

http://www.osvdb.org/23862

Source: cve@mitre.org

http://www.osvdb.org/23863

Source: cve@mitre.org

http://www.osvdb.org/23864

Source: cve@mitre.org

http://www.osvdb.org/24106

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/428659/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/17090

Source: cve@mitre.org

http://www.securityfocus.com/bid/30182

Source: cve@mitre.org

Exploit

http://www.vupen.com/english/advisories/2006/0943

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/25183

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/43718

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/43724

Source: cve@mitre.org

https://www.exploit-db.com/exploits/6040

Source: cve@mitre.org

http://evuln.com/vulns/95/summary.html