CVE-2006-4244
EPSS 1.6%sql-ledger
Published: 8/31/2006Modified: 4/28/2026
Description
SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.
Affected packages (2)
- Debian/sql-ledgerfrom 0, < 2.6.18-1
- Debian/sql-ledgerfrom 0, < 2.4.7-2sarge1