CVE-2006-3884

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-07-27 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in links.php in Gonafish LinksCaffe 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) offset and (2) limit parameters, (3) newdays parameter in a new action, and the (4) link_id parameter in a deadlink action. NOTE: this issue can also be used for path disclosure by a forced SQL error, or to modify PHP files using OUTFILE.

Affected products

Gonafish Linkscaffe: 3.0

References

http://secunia.com/advisories/21212
http://securityreason.com/securityalert/1287
http://securitytracker.com/id?1016584
http://www.osvdb.org/27518
http://www.securityfocus.com/archive/1/441087/100/0/threaded
http://www.securityfocus.com/bid/19149
http://www.vupen.com/english/advisories/2006/2983
https://exchange.xforce.ibmcloud.com/vulnerabilities/27961
https://exchange.xforce.ibmcloud.com/vulnerabilities/27962
http://secunia.com/advisories/21212
http://securityreason.com/securityalert/1287
http://securitytracker.com/id?1016584

Get alerted when CVE-2006-3884 or the next vulnerability affects your stack