CVE-2006-0444 json
SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via t…
published 2006-01-26 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0451
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.0%
- EPSS 3.0% chance of exploitation in 30 days, percentile 87%
- public exploits
- 1
- Exploit-DB
Summary
SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page. NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.
Patch / fix
- securityfocus.com/bid/16391 patch
- secunia.com/advisories/18597 advisory
Timeline
- First public exploit (EDB-1453)
- Published
Exploit prediction
3.05% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-1453 Phpclanwebsite 1.23.1 - SQL Injection webapps, 2006-01-25
- h4cky0u.org http://www.h4cky0u.org/advisories/HYSA-2006-002-phpclan.txt referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
References
-
securityfocus.com
/bid/16391
vdb-entry, patch
-
secunia.com
/advisories/18597
third-party-advisory, patch, vendor-advisory
-
h4cky0u.org
/advisories/HYSA-2006-002-phpclan.txt
exploit, vendor-advisory
-
securityfocus.com
/archive/1/423145/100/0/threaded
mailing-list
-
osvdb.org
/22722
vdb-entry
-
osvdb.org
/22720
vdb-entry
-
vupen.com
/english/advisories/2006/0342
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/24355
vdb-entry
Sources
- CVE List CVE-2006-0444
- NVD CVE-2006-0444
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.