CVE-2006-3860

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-08-17 · updated 2026-06-16

Description

IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the (1) "SET DEBUG FILE" SQL command, and the (2) start_onpload and (3) dbexp functions.

Affected products

IBM Informix Dynamic Database Server: 7.3, 7.31_.xd8, 9.4, 9.40.tc5, 9.40.uc1, 9.40.uc2 (+5)

References

http://secunia.com/advisories/21301
http://securityreason.com/securityalert/1407
http://www-1.ibm.com/support/docview.wss?uid=swg21242921
http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
http://www.osvdb.org/27686
http://www.securityfocus.com/archive/1/443133/100/0/threaded
http://www.securityfocus.com/archive/1/443185/100/0/threaded
http://www.securityfocus.com/bid/19264
http://www.vupen.com/english/advisories/2006/3077
https://exchange.xforce.ibmcloud.com/vulnerabilities/28121
https://exchange.xforce.ibmcloud.com/vulnerabilities/28124
http://secunia.com/advisories/21301

Get alerted when CVE-2006-3860 or the next vulnerability affects your stack