CVE-2006-1289: Milkeyway Captive Portal

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3) team, (4) level, (5) status, (6) teamname, and (7) teamlead parameters in (a) auth.php; the (8) username, (9) action, and (10) filter parameters in (b) authuser.php; the (11) username parameter in (c) utils.php; the (12) id and (13) date parameters in (d) traffic.php; the (14) username parameter in (e) userstatistics.php; and the (15) USERNAME and (16) PASSWORD parameters in a cookie to (f) chgpwd.php.

Affected products

• Milkeyway Milkeyway Captive Portal: version 0.1 only; version 0.1.1 only

Published 2006-03-19. Last modified 2026-06-16.