CVE-2006-6233

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-12-02 · updated 2026-06-16

Description

SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewdownloaddetails operation. NOTE: this issue might have been in the viewdownloaddetails function in dl-downloaddetails.php, but PostNuke 0.764 does not appear to have this issue.

Affected products

Postnuke Software Foundation Postnuke: 0.76_rc4, 0.76_rc4a, 0.76_rc4b, 0.760_rc2, 0.760_rc3, 0.760_rc4 (+4)

References

http://securityreason.com/securityalert/1952
http://www.securityfocus.com/archive/1/437832/100/200/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/27501
http://securityreason.com/securityalert/1952
http://www.securityfocus.com/archive/1/437832/100/200/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/27501

Get alerted when CVE-2006-6233 or the next vulnerability affects your stack