EUVD-2007-3661

Malware in sbrugna...

EVisit Analyst ID参数SQL注入漏洞

BUGTRAQ ID: 24849 CNCAN ID:CNCAN-2007071101 EVisit Analyst是一款基于PHP的WEB应用程序。 EVisit Analyst不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于脚本对用户提交的'id'参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 Maxsi eVisit Analyst 目前没有解决方案提供： http://www.evisitanalyst.com/...

CVE-2007-3677

Multiple SQL injection vulnerabilities in Maxsi eVisit Analyst allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 idsp1.pl, 2 ip.pl, and 3 einsitedirector.pl. NOTE: this issue can be leveraged for path disclosure from resulting error messages...

Sql injection

Multiple SQL injection vulnerabilities in Maxsi eVisit Analyst allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 idsp1.pl, 2 ip.pl, and 3 einsitedirector.pl. NOTE: this issue can be leveraged for path disclosure from resulting error messages...

CVE-2007-3677

CVE-2007-3677 affects Maxsi eVisit Analyst. Multiple SQL injection vulnerabilities allow remote attackers to supply id to (1) idsp1.pl, (2) ip.pl, and (3) einsite_director.pl, enabling arbitrary SQL execution and potentially path disclosure through error messages. Exploitation details and fixes a...

CVE-2007-3677: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Maxsi eVisit Analyst allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 idsp1.pl, 2 ip.pl, and 3 einsitedirector.pl. NOTE: this issue can be leveraged for path disclosure from resulting error messages...