{"api_version":"1","generated_at":"2026-07-02T19:30:35+00:00","cve":"CVE-2006-5840","urls":{"html":"https://cve.report/CVE-2006-5840","api":"https://cve.report/api/cve/CVE-2006-5840.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-5840","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-5840"},"summary":{"title":"CVE-2006-5840","description":"** DISPUTED **  Multiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the (1) neid parameter to newsdetails.php, or the (2) slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853.  NOTE: the vendor has notified CVE that the current version only creates static pages, and that slistl.php/slid never existed in any version.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-11-10 02:07:00","updated_at":"2023-11-07 01:59:00"},"problem_types":["CWE-89"],"metrics":[],"references":[{"url":"http://www.osvdb.org/30249","name":"30249","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2006/4418","name":"ADV-2006-4418","refsource":"VUPEN","tags":["Vendor Advisory"],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/450946/100/0/threaded","name":"20061108 Abarcar Realty Portal [injection sql]","refsource":"BUGTRAQ","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30135","name":"abarcar-realty-newsdetails-sql-injection(30135)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/22792","name":"22792","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"abarcar Realty Portal \"neid\" SQL Injection - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/20970","name":"20970","refsource":"BID","tags":["Exploit","Patch"],"title":"Abarcar Realty Portal Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securityreason.com/securityalert/1840","name":"1840","refsource":"SREASON","tags":[],"title":"Abarcar Realty Portal  [injection sql] - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://attrition.org/pipermail/vim/2006-December/001190.html","name":"20061219 abarcar vendor statement on CVE-2006-5840","refsource":"VIM","tags":[],"title":"[VIM] abarcar vendor statement on CVE-2006-5840","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://s-a-p.ca/index.php?page=OurAdvisories&id=7","name":"http://s-a-p.ca/index.php?page=OurAdvisories&id=7","refsource":"MISC","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"http://www.osvdb.org/30250","name":"30250","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.attrition.org/pipermail/vim/2006-December/001170.html","name":"20061207 Vendor dispute - CVE-2006-5840 (abarcar Realty Portal)","refsource":"VIM","tags":[],"title":"[VIM] Vendor dispute - CVE-2006-5840 (abarcar Realty Portal)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-5840","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-5840","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"5840","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"abarcar","cpe5":"abarcar_realty_portal","cpe6":"5.1.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"5840","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"abarcar","cpe5":"abarcar_realty_portal","cpe6":"6.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"5840","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"abarcar","cpe5":"abarcar_realty_portal","cpe6":"5.1.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"5840","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"abarcar","cpe5":"abarcar_realty_portal","cpe6":"6.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[{"cvename":"CVE-2006-5840","organization":"abarcar Software","lastmodified":"2006-12-20","contributor":"Helmut Fleischhauer","statementText":"The version 5.1.5 of the abarcar Realty Portal has been discontinued 2003. The version 6.xx has been discontinued beginning 2006. A fix for above versions has been available since that time. As of version 7.0 static pages are created - a parameter for cat.php is no longer used - the routine for news has been dropped and a different routine creating static pages is used - slistl.php never existed in the Realty Portal","cve_year":"2006","cve_id":"5840","crc32":"6b418328"}],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-5840","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"** DISPUTED **  Multiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the (1) neid parameter to newsdetails.php, or the (2) slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853.  NOTE: the vendor has notified CVE that the current version only creates static pages, and that slistl.php/slid never existed in any version."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"30249","refsource":"OSVDB","url":"http://www.osvdb.org/30249"},{"name":"1840","refsource":"SREASON","url":"http://securityreason.com/securityalert/1840"},{"name":"22792","refsource":"SECUNIA","url":"http://secunia.com/advisories/22792"},{"name":"20061219 abarcar vendor statement on CVE-2006-5840","refsource":"VIM","url":"http://attrition.org/pipermail/vim/2006-December/001190.html"},{"name":"20970","refsource":"BID","url":"http://www.securityfocus.com/bid/20970"},{"name":"http://s-a-p.ca/index.php?page=OurAdvisories&id=7","refsource":"MISC","url":"http://s-a-p.ca/index.php?page=OurAdvisories&id=7"},{"name":"abarcar-realty-newsdetails-sql-injection(30135)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30135"},{"name":"ADV-2006-4418","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/4418"},{"name":"30250","refsource":"OSVDB","url":"http://www.osvdb.org/30250"},{"name":"20061207 Vendor dispute - CVE-2006-5840 (abarcar Realty Portal)","refsource":"VIM","url":"http://www.attrition.org/pipermail/vim/2006-December/001170.html"},{"name":"20061108 Abarcar Realty Portal [injection sql]","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/450946/100/0/threaded"}]}},"nvd":{"publishedDate":"2006-11-10 02:07:00","lastModifiedDate":"2023-11-07 01:59:00","problem_types":["CWE-89"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:abarcar:abarcar_realty_portal:5.1.5:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:abarcar:abarcar_realty_portal:6.0.1:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"5840","Ordinal":"21186","Title":"CVE-2006-5840","CVE":"CVE-2006-5840","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"5840","Ordinal":"1","NoteData":"** DISPUTED **\n\nMultiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the (1) neid parameter to newsdetails.php, or the (2) slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853.  NOTE: the vendor has notified CVE that the current version only creates static pages, and that slistl.php/slid never existed in any version.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"5840","Ordinal":"2","NoteData":"2006-11-09","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"5840","Ordinal":"3","NoteData":"2018-10-17","Type":"Other","Title":"Modified"}]}}}