CVE-2006-0088: SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbit

This month

HIGH 7.5DOWNGRADE

CVE-2006-0088 is a high-severity flaw (CVSS 7.5) affecting intouch. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.

Why this priority

High severity
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.5 (High)
EPSS exploit chance	1.3% (top 30%)
CISA exploited list	No
Published	2006-01-05
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: intouch

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-01-05 11:03 UTCPublished CVE record published
2026-06-16 22:19 UTCUpdated Record last modified

intouch intouch DOWNGRADE

Affected: 0.5.1_alpha

Fixed in: no fixed release known

Safe to downgrade to: a release before 0.5.1_alpha

1. Check installed version

apt-cache policy intouch || rpm -q intouch || intouch --version

2. No fixed release: DOWNGRADE to a release before 0.5.1_alpha (Debian / Ubuntu)

apt-cache madison intouch sudo apt install intouch=<VERSION_BEFORE_0.5.1_alpha> sudo apt-mark hold intouch

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list intouch sudo dnf downgrade intouch-<VERSION_BEFORE_0.5.1_alpha> sudo dnf versionlock add intouch

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: InTouch 0.5.1 Alpha - User Variable SQL Injection

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-0088?

intouch: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2006-0088 being exploited?

CVE-2006-0088 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-0088 affect?

CVE-2006-0088 affects intouch. Severity is high (CVSS 7.5). SQL injection vulnerability in intouch.lib.php in inTouch 0.5.1 Alpha allows remote attackers to execute arbitrary SQL commands via the user parameter.

How urgent is CVE-2006-0088?

Priority 49/100. High severity; Public exploit reference

Software pages

PHP vulnerabilities

Related CVEs

CVE-2023-34982 MEDIUM 5.5 UPGRADE UPGRADE This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard pr
CVE-2023-33873 HIGH 7.8 UPGRADE UPGRADE This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standar
CVE-2015-1009 LOW 1.7 UPGRADE UPGRADE Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7
CVE-2012-3847 MEDIUM 5.0 DOWNGRADE DOWNGRADE slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 al
CVE-2012-3005 MEDIUM 6.9 DOWNGRADE UPGRADE Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware App

References

← Back to latest CVEs