Sql injection

Multiple SQL injection vulnerabilities in phpWebsite 0.83 and earlier allow remote attackers to execute arbitrary SQL commands via the sid parameter to 1 friend.php or 2 article.php...

CVE-2006-1330: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in phpWebsite 0.83 and earlier allow remote attackers to execute arbitrary SQL commands via the sid parameter to 1 friend.php or 2 article.php...

CVE-2005-4169: Undefined Security Weakness

Multiple SQL injection vulnerabilities in eFiction 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 let parameter in a viewlist action to authors.php and 2 sid parameter to viewstory.php...

CVE-2005-3951: Undefined Security Weakness

SQL injection vulnerability in survey.php in PHP Labs Survey Wizard allows remote attackers to execute arbitrary SQL commands via the sid parameter...

CVE-2005-3811: Undefined Security Weakness

Directory traversal vulnerability in admin/main.php in AMAX Magic Winmail Server 4.2 build 0824 and earlier allows remote attackers to overwrite arbitrary files with session information via the sid parameter...

CVE-2002-2178: Undefined Security Weakness

Cross-site scripting XSS vulnerability in article.php module for phpWebSite 0.8.3 allows remote attackers to execute arbitrary Javascript script via the sid parameter, as demonstrated using an IMG tag...

CVE-2005-3206: Undefined Security Weakness

iSQLPlus isqlplus for Oracle9i Database Server Release 2 9.0.2.4 allows remote attackers to cause a denial of service TNS listener stop via an HTTP request with an sid parameter that contains a STOP command...

phpTourney 0.8.0 SQL-Injection

Продукт: phpTourney Версия: 0.8.0 Уязвимость: Не проверяется параметр sid на наличие SQL-команд Пример: http://any.site.org/folder/?sid=220UNION20SELECT20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/ Контакты: http://adz.void.ru/ [email protected]...