CVE-2006-5629

HOCH 7.5CVE-2006-5629 · Published 31/10/2006 · updated 16/06/2026

Package	Affected versions	Patched versions
hosting controller hosting_controller	`= 1.1= 1.3= 1.4= 1.4.1= 1.4b= 2002= 2002_rc_1= 6.1= 6.1_hotfix_1.4= 6.1_hotfix_1.7= 6.1_hotfix_1.9= 6.1_hotfix_2.0= 6.1_hotfix_2.1= 6.1_hotfix_2.2= 6.1_hotfix_2.3= 6.1_hotfix_2.4= 6.1_hotfix_3.1≤ 6.1_hotfix_3.2`	No fix yet

Description

Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands via the ForumID parameter in (1) DisableForum.asp and (2) enableForum.asp. NOTE: it was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.

References

hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html
secunia.com/advisories/22607 · Vendor Advisory
secunia.com/advisories/28973 · Vendor Advisory
securitytracker.com/id · Exploit
kapda.ir/advisory-442.html · Exploit
securityfocus.com/archive/1/485028/100/0/threaded
securityfocus.com/bid/20661 · Exploit
securityfocus.com/bid/26862
vupen.com/english/advisories/2006/4296 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/39036
exploit-db.com/exploits/4730

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free