{"api_version":"1","generated_at":"2026-07-23T14:50:22+00:00","cve":"CVE-2006-0240","urls":{"html":"https://cve.report/CVE-2006-0240","api":"https://cve.report/api/cve/CVE-2006-0240.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-0240","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-0240"},"summary":{"title":"CVE-2006-0240","description":"Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-01-18 01:07:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.hackerscenter.com/archive/view.asp?id=21926","name":"http://www.hackerscenter.com/archive/view.asp?id=21926","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[HSC] SimpleBlog 2.1 Multiple SQL injection / XSS : Hackers Center : Internet Security Archive: Exploits, Patch, Security Articles, Advisories","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/422102/100/0/threaded","name":"http://www.securityfocus.com/archive/1/422102/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24155","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24155","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/18488","name":"http://secunia.com/advisories/18488","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"SimpleBlog Script Insertion and SQL Injection Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/16243","name":"http://www.securityfocus.com/bid/16243","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"8Pixel.net SimpleBlog Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2006/0194","name":"http://www.vupen.com/english/advisories/2006/0194","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/22447","name":"http://www.osvdb.org/22447","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-0240","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-0240","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"240","vulnerable":"1","versionEndIncluding":"2.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"8pixel.net","cpe5":"simple_blog","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:25:34.077Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"ADV-2006-0194","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/0194"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.hackerscenter.com/archive/view.asp?id=21926"},{"name":"16243","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/16243"},{"name":"22447","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/22447"},{"name":"20060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.1","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/422102/100/0/threaded"},{"name":"simpleblog-month-sql-injection(24155)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24155"},{"name":"18488","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/18488"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-01-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-19T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"ADV-2006-0194","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/0194"},{"tags":["x_refsource_MISC"],"url":"http://www.hackerscenter.com/archive/view.asp?id=21926"},{"name":"16243","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/16243"},{"name":"22447","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/22447"},{"name":"20060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.1","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/422102/100/0/threaded"},{"name":"simpleblog-month-sql-injection(24155)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24155"},{"name":"18488","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/18488"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-0240","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ADV-2006-0194","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/0194"},{"name":"http://www.hackerscenter.com/archive/view.asp?id=21926","refsource":"MISC","url":"http://www.hackerscenter.com/archive/view.asp?id=21926"},{"name":"16243","refsource":"BID","url":"http://www.securityfocus.com/bid/16243"},{"name":"22447","refsource":"OSVDB","url":"http://www.osvdb.org/22447"},{"name":"20060114 [HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.1","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/422102/100/0/threaded"},{"name":"simpleblog-month-sql-injection(24155)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24155"},{"name":"18488","refsource":"SECUNIA","url":"http://secunia.com/advisories/18488"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-0240","datePublished":"2006-01-18T01:00:00.000Z","dateReserved":"2006-01-18T00:00:00.000Z","dateUpdated":"2024-08-07T16:25:34.077Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-01-18 01:07:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:8pixel.net:simple_blog:*:*:*:*:*:*:*:*","versionEndIncluding":"2.1","matchCriteriaId":"F539872D-187C-4421-9886-BB909FABB1ED"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"240","Ordinal":"1","Title":"CVE-2006-0240","CVE":"CVE-2006-0240","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"240","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in Simple Blog 2.1 allow remote attackers to execute arbitrary SQL commands via the month parameter in an archives view operation and possibly certain other parameters in unspecified scripts.","Type":"Description","Title":"CVE-2006-0240"},{"CveYear":"2006","CveId":"240","Ordinal":"2","NoteData":"2006-01-17","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"240","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}