CVE-2006-3860

high

Description

IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the (1) "SET DEBUG FILE" SQL command, and the (2) start_onpload and (3) dbexp functions.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/28124

https://exchange.xforce.ibmcloud.com/vulnerabilities/28121

http://www.vupen.com/english/advisories/2006/3077

http://www.securityfocus.com/bid/19264

http://www.securityfocus.com/archive/1/443185/100/0/threaded

http://www.securityfocus.com/archive/1/443133/100/0/threaded

http://www.osvdb.org/27686

http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf

http://www-1.ibm.com/support/docview.wss?uid=swg21242921

http://securityreason.com/securityalert/1407

http://secunia.com/advisories/21301

Details

Source: Mitre, NVD

Published: 2006-08-17

Updated: 2018-10-17

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H