PT-2012-5309

Name of the Vulnerable Software and Affected Versions Travelon Express version 6.2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via several API endpoints, including "holiday.php" and "holiday book.php" using the hid parameter, "pages.php"...

CVE-2012-4281: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Travelon Express 6.2.2 allow remote attackers to execute arbitrary SQL commands via the hid parameter to 1 holiday.php or 2 holidaybook.php, 3 id parameter to pages.php, 4 fid parameter to admin/airline-edit.php, or 5 cid parameter to...