[SA18685] Daffodil CRM Login SQL Injection Vulnerability

TITLE: Daffodil CRM Login SQL Injection Vulnerability SECUNIA ADVISORY ID: SA18685 VERIFY ADVISORY: http://secunia.com/advisories/18685/ CRITICAL: Moderately critical IMPACT: Security Bypass, Manipulation of data WHERE: From remote SOFTWARE: Daffodil CRM 1.x http://secunia.com/product/7293/...

Sql injection

SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action...

CVE-2006-0510

SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action...

CVE-2006-0510

CVE-2006-0510 describes a SQL injection vulnerability in the Daffodil CRM 1.5 web application, specifically in the login flow handled by login action in the file userlogin.jsp. The issue allows remote attackers to manipulate SQL queries via unspecified login parameters, enabling arbitrary SQL exe...

CVE-2006-0510

SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action...

CVE-2006-0510: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in userlogin.jsp in Daffodil CRM 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified parameters in a login action...

Daffodil CRM 1.5 - Userlogin.asp SQL Injection

Daffodil CRM 1.5 - Userlogin.asp SQL Injection source: https://www.securityfocus.com/bid/16433/info Daffodil CRM is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

Daffodil CRM 1.5 - 'Userlogin.asp' SQL Injection

source: https://www.securityfocus.com/bid/16433/info Daffodil CRM is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could allow an attacker to compromise t...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln 1 APPS02 in the a CRM Technical Foundation component; 2 APPS03 in the b iProcurement component; and 3 APPS04, 4 APPS05, and 5 APPS06 in...

CVE-2006-0278

Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln 1 APPS02 in the a CRM Technical Foundation component; 2 APPS03 in the b iProcurement component; and 3 APPS04, 4 APPS05, and 5 APPS06 in...

CVE-2006-0278

Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln 1 APPS02 in the a CRM Technical Foundation component; 2 APPS03 in the b iProcurement component; and 3 APPS04, 4 APPS05, and 5 APPS06 in...

CVE-2006-0278: Undefined Security Weakness

Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.9 have unspecified impact and attack vectors, as identified by Oracle Vuln 1 APPS02 in the a CRM Technical Foundation component; 2 APPS03 in the b iProcurement component; and 3 APPS04, 4 APPS05, and 5 APPS06 in...

vTiger < 4.5a2 Multiple Vulnerabilities

The remote version of this software is prone to arbitrary code execution, directory traversal, SQL injection allowing authentication bypass, cross-site scripting attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

CVE-2005-4086

Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management SugarCRM 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter...

CVE-2005-4086

Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management SugarCRM 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter...

SEC-20051125-0.txt

SEC-CONSULT Security Advisory ======================================================================= title: Even More Vulnerabilities in VTiger CRM program: vtiger CRM vulnerable version: 4.2 and earlier homepage: http://www.vtiger.com found: 2005-11-06 by: D. Fabian / SEC-CONSULT /...

Hardened-PHP Project Security Advisory 2005-23.105

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Multiple vulnerabilities in vTiger CRM Release Date: 2005/11/24 Last Modified: 2005/11/24 Author: Christopher Kunz Application: vTiger 4.2 and prior Severity: Cross-Site...

CVE-2005-3821

Cross-site scripting XSS vulnerability in vTiger CRM 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via multiple vectors, including the account name...

CVE-2005-3822

Multiple SQL injection vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username in the login form or 2 record parameter, as demonstrated in the EditView action for the Contacts module...

CVE-2005-3818

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 various input fields, including the contact, lead, and first or last name fields, 2 the record parameter in a DetailView action in the Leads module f...