Sql injection

Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to a userlogin.php and b managerlogin.php. NOTE: some of these details are obtained...

CVE-2010-1053

Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to a userlogin.php and b managerlogin.php. NOTE: some of these details are obtained...

CVE-2010-1053: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to a userlogin.php and b managerlogin.php. NOTE: some of these details are obtained...

Zen Tracking 2.2 - Authentication Bypass

Zen Tracking 2.2 - Authentication Bypass + Zen Tracking + Download : http://scripts.ringsworld.com/calendars/zentimetracking/ + Vuln Code : userlogin.php if !empty$POST'password' $username =$POST'username'; $password =$POST'password'; dbConnect; $result1 = mysqlquery"select from ".$tbluser." wher...