CVE-2006-4244

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name	Vendor	Start Version	End Version
Sql-ledger	Sql-ledger	2.4.4 (including)	2.4.4 (including)
Sql-ledger	Sql-ledger	2.4.5 (including)	2.4.5 (including)
Sql-ledger	Sql-ledger	2.4.6 (including)	2.4.6 (including)
Sql-ledger	Sql-ledger	2.4.7 (including)	2.4.7 (including)
Sql-ledger	Sql-ledger	2.4.8 (including)	2.4.8 (including)
Sql-ledger	Sql-ledger	2.4.9 (including)	2.4.9 (including)
Sql-ledger	Sql-ledger	2.4.10 (including)	2.4.10 (including)
Sql-ledger	Sql-ledger	2.4.11 (including)	2.4.11 (including)
Sql-ledger	Sql-ledger	2.4.12 (including)	2.4.12 (including)
Sql-ledger	Sql-ledger	2.4.13 (including)	2.4.13 (including)
Sql-ledger	Sql-ledger	2.4.14 (including)	2.4.14 (including)
Sql-ledger	Sql-ledger	2.4.15 (including)	2.4.15 (including)
Sql-ledger	Sql-ledger	2.4.16 (including)	2.4.16 (including)
Sql-ledger	Sql-ledger	2.6.0 (including)	2.6.0 (including)
Sql-ledger	Sql-ledger	2.6.1 (including)	2.6.1 (including)
Sql-ledger	Sql-ledger	2.6.2 (including)	2.6.2 (including)
Sql-ledger	Sql-ledger	2.6.3 (including)	2.6.3 (including)
Sql-ledger	Sql-ledger	2.6.4 (including)	2.6.4 (including)
Sql-ledger	Sql-ledger	2.6.5 (including)	2.6.5 (including)
Sql-ledger	Sql-ledger	2.6.6 (including)	2.6.6 (including)
Sql-ledger	Sql-ledger	2.6.7 (including)	2.6.7 (including)
Sql-ledger	Sql-ledger	2.6.8 (including)	2.6.8 (including)
Sql-ledger	Sql-ledger	2.6.9 (including)	2.6.9 (including)
Sql-ledger	Sql-ledger	2.6.10 (including)	2.6.10 (including)
Sql-ledger	Sql-ledger	2.6.11 (including)	2.6.11 (including)
Sql-ledger	Sql-ledger	2.6.12 (including)	2.6.12 (including)
Sql-ledger	Sql-ledger	2.6.13 (including)	2.6.13 (including)
Sql-ledger	Sql-ledger	2.6.14 (including)	2.6.14 (including)
Sql-ledger	Sql-ledger	2.6.15 (including)	2.6.15 (including)
Sql-ledger	Sql-ledger	2.6.16 (including)	2.6.16 (including)
Sql-ledger	Sql-ledger	2.6.17 (including)	2.6.17 (including)
Sql-ledger	Sql-ledger	2.6.18 (including)	2.6.18 (including)
Sql-ledger	Sql-ledger	2.6.19 (including)	2.6.19 (including)
Sql-ledger	Sql-ledger	2.6.20 (including)	2.6.20 (including)
Sql-ledger	Sql-ledger	2.6.21 (including)	2.6.21 (including)
Sql-ledger	Sql-ledger	2.6.22 (including)	2.6.22 (including)
Sql-ledger	Sql-ledger	2.6.23 (including)	2.6.23 (including)
Sql-ledger	Sql-ledger	2.6.24 (including)	2.6.24 (including)
Sql-ledger	Sql-ledger	2.6.25 (including)	2.6.25 (including)
Sql-ledger	Sql-ledger	2.6.26 (including)	2.6.26 (including)
Sql-ledger	Sql-ledger	2.6.27 (including)	2.6.27 (including)
Sql-ledger	Sql-ledger	2.8.0 (including)	2.8.0 (including)
Sql-ledger	Sql-ledger	2.8.1 (including)	2.8.1 (including)
Sql-ledger	Sql-ledger	2.8.2 (including)	2.8.2 (including)
Sql-ledger	Sql-ledger	2.8.3 (including)	2.8.3 (including)
Sql-ledger	Sql-ledger	2.8.4 (including)	2.8.4 (including)
Sql-ledger	Sql-ledger	2.8.5 (including)	2.8.5 (including)
Sql-ledger	Sql-ledger	2.8.6 (including)	2.8.6 (including)
Sql-ledger	Sql-ledger	2.8.7 (including)	2.8.7 (including)
Sql-ledger	Sql-ledger	2.8.8 (including)	2.8.8 (including)
Sql-ledger	Sql-ledger	2.8.9 (including)	2.8.9 (including)
Sql-ledger	Sql-ledger	2.8.10 (including)	2.8.10 (including)
Sql-ledger	Sql-ledger	2.8.11 (including)	2.8.11 (including)
Sql-ledger	Sql-ledger	2.8.12 (including)	2.8.12 (including)
Sql-ledger	Sql-ledger	2.8.13 (including)	2.8.13 (including)
Sql-ledger	Sql-ledger	2.8.14 (including)	2.8.14 (including)
Sql-ledger	Sql-ledger	2.8.15 (including)	2.8.15 (including)
Sql-ledger	Sql-ledger	2.8.16 (including)	2.8.16 (including)
Sql-ledger	Sql-ledger	2.8.17 (including)	2.8.17 (including)
Sql-ledger	Sql-ledger	2.8.18 (including)	2.8.18 (including)
Sql-ledger	Ubuntu	dapper	*
Sql-ledger	Ubuntu	devel	*
Sql-ledger	Ubuntu	edgy	*
Sql-ledger	Ubuntu	feisty	*
Sql-ledger	Ubuntu	gutsy	*
Sql-ledger	Ubuntu	hardy	*
Sql-ledger	Ubuntu	intrepid	*
Sql-ledger	Ubuntu	jaunty	*
Sql-ledger	Ubuntu	karmic	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2006-4244
CWE	https://cwe.mitre.org/data/definitions/287.html

Improper Authentication

Weakness

Affected Software

Potential Mitigations

References

CVE-2006-4244

Improper Authentication

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References