{"api_version":"1","generated_at":"2026-07-23T08:37:46+00:00","cve":"CVE-2006-1541","urls":{"html":"https://cve.report/CVE-2006-1541","api":"https://cve.report/api/cve/CVE-2006-1541.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-1541","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-1541"},"summary":{"title":"CVE-2006-1541","description":"SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-03-30 11:02:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.8","severity":"","vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:N/A:N","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.nukedx.com/?viewdoc=22","name":"http://www.nukedx.com/?viewdoc=22","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Exploit Database - Exploits for Penetration Testers, Researchers, and Ethical Hackers","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=full-disclosure&m=114367573519326&w=2","name":"http://marc.info/?l=full-disclosure&m=114367573519326&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'[Full-disclosure] EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25544","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25544","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/24256","name":"http://www.osvdb.org/24256","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/17309","name":"http://www.securityfocus.com/bid/17309","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"EzASPSite Default.ASP SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/19441","name":"http://secunia.com/advisories/19441","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"EzASPSite \"scheme\" Parameter SQL Injection Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/1164","name":"http://www.vupen.com/english/advisories/2006/1164","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/1623","name":"https://www.exploit-db.com/exploits/1623","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"EzASPSite 2.0 RC3 - 'Scheme' SQL Injection - ASP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/429487/100/0/threaded","name":"http://www.securityfocus.com/archive/1/429487/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-1541","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-1541","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"1541","vulnerable":"1","versionEndIncluding":"2.0_rc3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ezaspsite","cpe5":"ezaspsite","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2006","cve_id":"1541","cve":"CVE-2006-1541","epss":"0.014770000","percentile":"0.810100000","score_date":"2026-04-19","updated_at":"2026-04-20 00:11:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T17:19:48.672Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1623","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/1623"},{"name":"19441","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/19441"},{"name":"ADV-2006-1164","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/1164"},{"name":"17309","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/17309"},{"name":"24256","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/24256"},{"name":"ezaspsite-default-sql-injection(25544)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25544"},{"name":"20060329 EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit Vulnerability.","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/429487/100/0/threaded"},{"name":"20060329 EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit Vulnerability.","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://marc.info/?l=full-disclosure&m=114367573519326&w=2"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.nukedx.com/?viewdoc=22"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-03-29T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-18T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1623","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/1623"},{"name":"19441","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/19441"},{"name":"ADV-2006-1164","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/1164"},{"name":"17309","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/17309"},{"name":"24256","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/24256"},{"name":"ezaspsite-default-sql-injection(25544)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25544"},{"name":"20060329 EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit Vulnerability.","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/429487/100/0/threaded"},{"name":"20060329 EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit Vulnerability.","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://marc.info/?l=full-disclosure&m=114367573519326&w=2"},{"tags":["x_refsource_MISC"],"url":"http://www.nukedx.com/?viewdoc=22"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-1541","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1623","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/1623"},{"name":"19441","refsource":"SECUNIA","url":"http://secunia.com/advisories/19441"},{"name":"ADV-2006-1164","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/1164"},{"name":"17309","refsource":"BID","url":"http://www.securityfocus.com/bid/17309"},{"name":"24256","refsource":"OSVDB","url":"http://www.osvdb.org/24256"},{"name":"ezaspsite-default-sql-injection(25544)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25544"},{"name":"20060329 EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit Vulnerability.","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/429487/100/0/threaded"},{"name":"20060329 EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit Vulnerability.","refsource":"FULLDISC","url":"http://marc.info/?l=full-disclosure&m=114367573519326&w=2"},{"name":"http://www.nukedx.com/?viewdoc=22","refsource":"MISC","url":"http://www.nukedx.com/?viewdoc=22"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-1541","datePublished":"2006-03-30T11:00:00.000Z","dateReserved":"2006-03-30T00:00:00.000Z","dateUpdated":"2024-08-07T17:19:48.672Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-03-30 11:02:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:N/A:N","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ezaspsite:ezaspsite:*:*:*:*:*:*:*:*","versionEndIncluding":"2.0_rc3","matchCriteriaId":"1A88D784-6700-49BD-B4AD-3887EAB385C8"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"1541","Ordinal":"1","Title":"CVE-2006-1541","CVE":"CVE-2006-1541","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"1541","Ordinal":"1","NoteData":"SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter.","Type":"Description","Title":"CVE-2006-1541"},{"CveYear":"2006","CveId":"1541","Ordinal":"2","NoteData":"2006-03-30","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"1541","Ordinal":"3","NoteData":"2018-10-18","Type":"Other","Title":"Modified"}]}}}