CVE-2006-5228

Vulnerability

The login.php script in the gadget/ directory of ackerTodo version 4.2 and earlier contains multiple SQL injection vulnerabilities. The parameters up_login, up_pass, and up_num_tasks are not sanitized before being used in SQL queries, allowing an attacker to inject arbitrary SQL commands. [1]

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP POST request to gadget/login.php with malicious SQL in any of the three parameters. No authentication is required as the login page is publicly accessible. The attacker only needs network access to the web server.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the underlying database. This can lead to unauthorized access to user credentials, modification of todo lists, or complete compromise of the application's data.

Mitigation

The vulnerability was fixed in CVS revision 1.4 of login.php [2]. Users should upgrade to a version later than 4.2 or apply the patch from the CVS repository. No official release with the fix is mentioned in the references.