EUVD-2010-4858

Malware in sbrugna...

CVE-2010-4894: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to execute arbitrary SQL commands via the name parameter. NOTE: some of these details are obtained from third party information...

CVE-2010-4895: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in core/showsite.php in chillyCMS 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the name parameter aka the username field. NOTE: some of these details are obtained from third party information...