CVE-2006-7115

critical

Description

SQL injection vulnerability in PHPKit 1.6.1 RC2 allows remote attackers to inject arbitrary SQL commands via the catid parameter to include.php when the path parameter is set to faq/faq.php, and other unspecified vectors involving guestbook/print.php.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/30209

http://www.securityfocus.com/archive/1/451304/100/0/threaded

http://www.osvdb.org/31265

http://www.bb-pcsecurity.de/websecurity/532/org/PHPKit_1.6.1_RC2_%28faq-faq.php%29_Remote_SQL_Injection_Exploit.htm

http://securityreason.com/securityalert/2357

http://secunia.com/advisories/17479

Details

Source: Mitre, NVD

Published: 2007-03-06

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00706