CVE-2006-5629

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-10-31 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in Hosting Controller 6.1 before Hotfix 3.3 allow remote attackers to execute arbitrary SQL commands via the ForumID parameter in (1) DisableForum.asp and (2) enableForum.asp. NOTE: it was later reported that the vulnerability is present in 6.1 Hotfix 3.3 and earlier.

Affected products

Hosting Controller: through 6.1_hotfix_3.2; 1.1, 1.3, 1.4, 1.4.1, 1.4b, 6.1 (+11)

References

http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html
http://secunia.com/advisories/22607
http://secunia.com/advisories/28973
http://securitytracker.com/id?1017103
http://www.kapda.ir/advisory-442.html
http://www.securityfocus.com/archive/1/485028/100/0/threaded
http://www.securityfocus.com/bid/20661
http://www.securityfocus.com/bid/26862
http://www.vupen.com/english/advisories/2006/4296
https://exchange.xforce.ibmcloud.com/vulnerabilities/39036
https://www.exploit-db.com/exploits/4730
http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html

Get alerted when CVE-2006-5629 or the next vulnerability affects your stack