EUVD-2010-4858

Malware in sbrugna...

CVE-2010-4894: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information...

CVE-2010-4895: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the name parameter aka the username field. NOTE: some of these details are obtained from third party information...

PT-2011-1829

Name of the Vulnerable Software and Affected Versions chillyCMS version 1.1.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the name parameter in the core/showsite.php file. Recommendations For chillyCMS version 1.1.3, avoid using the name...

PT-2011-1830

Name of the Vulnerable Software and Affected Versions chillyCMS version 1.1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the name parameter, also known as the username field. Recommendations For...