[eVuln] aWebNews Multiple XSS and SQL Injection Vulnerabilities

New eVuln Advisory: aWebNews Multiple XSS and SQL Injection Vulnerabilities http://evuln.com/vulns/116/summary.html --------------------Summary---------------- eVuln ID: EV0116 CVE: CVE-2006-1612 CVE-2006-1613 Software: aWebNews Sowtware's Web Site: http://labs.aweb.com.au/awebnews.php Versions:...

Sql injection

Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 user123 variable in a login.php or b fpass.php; or 2 cid parameter to c visview.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 yname, 2 emailadd, 3 subject, and 4 comment parameters...

CVE-2006-1613

Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 user123 variable in a login.php or b fpass.php; or 2 cid parameter to c visview.php...

CVE-2006-1612

CVE-2006-1612 concerns aWebNews 1.0, where visview.php is vulnerable to multiple XSS flaws. Remote attackers can inject arbitrary script/HTML via the yname, emailadd, subject, and comment parameters due to inadequate input sanitization. Multiple sources (NVD, CVE records, and eVuln advisory) conf...

CVE-2006-1613

CVE-2006-1613 affects aWebNews 1.0. The vulnerable components are login.php, fpass.php, and visview.php, where unsanitized inputs (user123 variable in login.php/fpass.php; cid in visview.php) are used in SQL queries, enabling remote SQL injection. The vulnerability is described across multiple so...

CVE-2006-1612

Multiple cross-site scripting XSS vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 yname, 2 emailadd, 3 subject, and 4 comment parameters...

CVE-2006-1613

Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 user123 variable in a login.php or b fpass.php; or 2 cid parameter to c visview.php...

CVE-2006-1613: Undefined Security Weakness

Multiple SQL injection vulnerabilities in aWebNews 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 user123 variable in a login.php or b fpass.php; or 2 cid parameter to c visview.php...

CVE-2006-1612: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in visview.php in aWebNews 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 yname, 2 emailadd, 3 subject, and 4 comment parameters...

aWebNews 1.2 - visview.php?_GET[cid] SQL Injection

aWebNews 1.2 - visview.php?GETcid SQL Injection source: https://www.securityfocus.com/bid/17352/info aWebBB is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to...