RedDot CMS ioRD.asp文件SQL注入漏洞

BUGTRAQ ID: 28872 CVECAN ID: CVE-2008-1613 RedDot CMS是一款网站内容管理系统。 RedDot CMS的实现上存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击。 传送给RedDot CMS的IoRD.asp文件的LngId参数负责分配CMS应用的语言环境。由于没有正确地验证该参数便在SQL语句中使用，因此远程攻击者可以通过SQL注入攻击绕过限制访问数据库，从数据库中枚举信息。 RedDot CMS 7.5.1 RedDot ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

reddot-sql.txt

RedDot CMS SQL injection vulnerability CVE Number: CVE-2008-1613 http://www.irmplc.com/index.php/167-Advisory-026 Vulnerability Type/Importance: SQL injection/Critical Problem Discovered: 12 February 2008 Vendor Contacted: 19 February 2008 Advisory Published: 21 April 2008 Abstract: The RedDot CM...

CVE-2008-1613: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ioRD.asp in RedDot CMS 7.5 Build 7.5.0.48, and possibly other versions including 6.5 and 7.0, allows remote attackers to execute arbitrary SQL commands via the LngId parameter...