EUVD-2006-0332

Malware in sbrugna...

CVE-2006-5242: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Etomite Content Management System CMS before 0.6.1.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Design/Logic Flaw

Etomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a back door in manager/includes/todo.inc.php, which allows remote attackers to execute arbitrary commands via the "cij" parameter...

CVE-2006-0325: Improper Neutralization of Special Elements used in an OS Command

Etomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a back door in manager/includes/todo.inc.php, which allows remote attackers to execute arbitrary commands via the "cij" parameter...