SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the…
Priority LOW 37CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.
Why it matters now
EPSS 0.0185 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 60
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.4:*:*:*:*:*:*:* | 2.4.4 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.5:*:*:*:*:*:*:* | 2.4.5 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.6:*:*:*:*:*:*:* | 2.4.6 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.7:*:*:*:*:*:*:* | 2.4.7 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.8:*:*:*:*:*:*:* | 2.4.8 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.9:*:*:*:*:*:*:* | 2.4.9 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.10:*:*:*:*:*:*:* | 2.4.10 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.11:*:*:*:*:*:*:* | 2.4.11 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.12:*:*:*:*:*:*:* | 2.4.12 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.13:*:*:*:*:*:*:* | 2.4.13 | Vulnerable | Sql-ledger |
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.6:*:*:*:*:*:*:* Versions 2.4.6 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.7:*:*:*:*:*:*:* Versions 2.4.7 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.8:*:*:*:*:*:*:* Versions 2.4.8 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.9:*:*:*:*:*:*:* Versions 2.4.9 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.10:*:*:*:*:*:*:* Versions 2.4.10 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.11:*:*:*:*:*:*:* Versions 2.4.11 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.12:*:*:*:*:*:*:* Versions 2.4.12 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.13:*:*:*:*:*:*:* Versions 2.4.13 Vulnerable ·Sql-ledger
Show 50 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.14:*:*:*:*:*:*:* | 2.4.14 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.15:*:*:*:*:*:*:* | 2.4.15 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.4.16:*:*:*:*:*:*:* | 2.4.16 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.0:*:*:*:*:*:*:* | 2.6.0 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.1:*:*:*:*:*:*:* | 2.6.1 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.2:*:*:*:*:*:*:* | 2.6.2 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.3:*:*:*:*:*:*:* | 2.6.3 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.4:*:*:*:*:*:*:* | 2.6.4 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.5:*:*:*:*:*:*:* | 2.6.5 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.6:*:*:*:*:*:*:* | 2.6.6 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.7:*:*:*:*:*:*:* | 2.6.7 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.8:*:*:*:*:*:*:* | 2.6.8 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.9:*:*:*:*:*:*:* | 2.6.9 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.10:*:*:*:*:*:*:* | 2.6.10 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.11:*:*:*:*:*:*:* | 2.6.11 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.12:*:*:*:*:*:*:* | 2.6.12 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.13:*:*:*:*:*:*:* | 2.6.13 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.14:*:*:*:*:*:*:* | 2.6.14 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.15:*:*:*:*:*:*:* | 2.6.15 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.16:*:*:*:*:*:*:* | 2.6.16 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.17:*:*:*:*:*:*:* | 2.6.17 | Vulnerable | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.18:*:*:*:*:*:*:* | 2.6.18 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.19:*:*:*:*:*:*:* | 2.6.19 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.20:*:*:*:*:*:*:* | 2.6.20 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.21:*:*:*:*:*:*:* | 2.6.21 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.22:*:*:*:*:*:*:* | 2.6.22 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.23:*:*:*:*:*:*:* | 2.6.23 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.24:*:*:*:*:*:*:* | 2.6.24 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.25:*:*:*:*:*:*:* | 2.6.25 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.26:*:*:*:*:*:*:* | 2.6.26 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.6.27:*:*:*:*:*:*:* | 2.6.27 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.0:*:*:*:*:*:*:* | 2.8.0 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.1:*:*:*:*:*:*:* | 2.8.1 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.2:*:*:*:*:*:*:* | 2.8.2 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.3:*:*:*:*:*:*:* | 2.8.3 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.4:*:*:*:*:*:*:* | 2.8.4 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.5:*:*:*:*:*:*:* | 2.8.5 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.6:*:*:*:*:*:*:* | 2.8.6 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.7:*:*:*:*:*:*:* | 2.8.7 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.8:*:*:*:*:*:*:* | 2.8.8 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.9:*:*:*:*:*:*:* | 2.8.9 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.10:*:*:*:*:*:*:* | 2.8.10 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.11:*:*:*:*:*:*:* | 2.8.11 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.12:*:*:*:*:*:*:* | 2.8.12 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.13:*:*:*:*:*:*:* | 2.8.13 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.14:*:*:*:*:*:*:* | 2.8.14 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.15:*:*:*:*:*:*:* | 2.8.15 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.16:*:*:*:*:*:*:* | 2.8.16 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.17:*:*:*:*:*:*:* | 2.8.17 | Running on | Sql-ledger |
| cpe:2.3:a:sql-ledger:sql-ledger:2.8.18:*:*:*:*:*:*:* | 2.8.18 | Running on | Sql-ledger |
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.14:*:*:*:*:*:*:* Versions 2.4.14 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.15:*:*:*:*:*:*:* Versions 2.4.15 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.4.16:*:*:*:*:*:*:* Versions 2.4.16 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.4:*:*:*:*:*:*:* Versions 2.6.4 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.6:*:*:*:*:*:*:* Versions 2.6.6 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.7:*:*:*:*:*:*:* Versions 2.6.7 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.8:*:*:*:*:*:*:* Versions 2.6.8 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.9:*:*:*:*:*:*:* Versions 2.6.9 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.10:*:*:*:*:*:*:* Versions 2.6.10 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.11:*:*:*:*:*:*:* Versions 2.6.11 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.12:*:*:*:*:*:*:* Versions 2.6.12 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.13:*:*:*:*:*:*:* Versions 2.6.13 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.14:*:*:*:*:*:*:* Versions 2.6.14 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.15:*:*:*:*:*:*:* Versions 2.6.15 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.16:*:*:*:*:*:*:* Versions 2.6.16 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.17:*:*:*:*:*:*:* Versions 2.6.17 Vulnerable ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.18:*:*:*:*:*:*:* Versions 2.6.18 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.19:*:*:*:*:*:*:* Versions 2.6.19 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.20:*:*:*:*:*:*:* Versions 2.6.20 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.21:*:*:*:*:*:*:* Versions 2.6.21 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.22:*:*:*:*:*:*:* Versions 2.6.22 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.23:*:*:*:*:*:*:* Versions 2.6.23 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.24:*:*:*:*:*:*:* Versions 2.6.24 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.25:*:*:*:*:*:*:* Versions 2.6.25 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.26:*:*:*:*:*:*:* Versions 2.6.26 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.6.27:*:*:*:*:*:*:* Versions 2.6.27 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.3:*:*:*:*:*:*:* Versions 2.8.3 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.4:*:*:*:*:*:*:* Versions 2.8.4 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.5:*:*:*:*:*:*:* Versions 2.8.5 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.6:*:*:*:*:*:*:* Versions 2.8.6 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.7:*:*:*:*:*:*:* Versions 2.8.7 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.8:*:*:*:*:*:*:* Versions 2.8.8 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.9:*:*:*:*:*:*:* Versions 2.8.9 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.10:*:*:*:*:*:*:* Versions 2.8.10 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.11:*:*:*:*:*:*:* Versions 2.8.11 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.12:*:*:*:*:*:*:* Versions 2.8.12 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.13:*:*:*:*:*:*:* Versions 2.8.13 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.14:*:*:*:*:*:*:* Versions 2.8.14 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.15:*:*:*:*:*:*:* Versions 2.8.15 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.16:*:*:*:*:*:*:* Versions 2.8.16 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.17:*:*:*:*:*:*:* Versions 2.8.17 Running on ·Sql-ledger
- cpe:2.3:a:sql-ledger:sql-ledger:2.8.18:*:*:*:*:*:*:* Versions 2.8.18 Running on ·Sql-ledger
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2006-4244
- 2026-10-03 Alias added: GHSA-v76g-p5xj-4qm7
References
More Sql-ledger vulnerabilities
- TI-2007-01278 Directory traversal vulnerability in SQL-Ledger, and LedgerSMB before 1.1.5, allows… CVSS 2.0HIGH 10.0
- TI-2007-01379 Unspecified vulnerability in LedgerSMB before 1.1.5 and SQL-Ledger before 2.6.25 allows… CVSS 2.0HIGH 9.0
- TI-2008-03911 The CGI scripts in (1) LedgerSMB (LSMB) before 1.2.15 and (2) SQL-Ledger 2.8.17 and… CVSS 2.0HIGH 7.8
- TI-2007-01845 (1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access control lists by changing… CVSS 2.0HIGH 7.5
- TI-2007-01378 Unspecified vulnerability in admin.pl in SQL-Ledger before 2.6.26 and LedgerSMB before… CVSS 2.0HIGH 7.5
- TI-2009-04165 The default configuration of SQL-Ledger 2.8.24 allows remote attackers to perform… CVSS 2.0HIGH 7.5
Sources
- CVE-2006-4244 · CVE Program
- CVE-2006-4244 · NVD
- FIRST EPSS
- GHSA-v76g-p5xj-4qm7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences