CVE-2006-5872

Published: Dec 18, 2006Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

login.pl in SQL-Ledger before 2.6.21 and LedgerSMB before 1.1.5 allows remote attackers to execute arbitrary Perl code via the "-e" flag in the script parameter, which is used as an argument to the perl program.

Affected (1)

Products: Dws Systems Inc.: Sql Ledger

Dws Systems Inc.

1 product

Sql Ledger

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dws Systems Inc. Sql Ledger	Version 2.6.27

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (16)

http://secunia.com/advisories/23375

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23419

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1017391

Source: cve@mitre.org

http://www.debian.org/security/2006/dsa-1239

Source: cve@mitre.org

PatchVendor Advisory

http://www.securityfocus.com/archive/1/458300/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/21634

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/5043

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2007/0407

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23375