CVE-2014-1459: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

PT-2014-4194

Name of the Vulnerable Software and Affected Versions doorGets CMS versions 5.2 and earlier Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the position down id parameter in the dg-admin/index.php file. This can be leveraged using CSRF to all...