EUVD-2006-4943

Malware in sbrugna...

myreview-disclose.txt

Incorrect management of the submission and camera ready versions of submitted papers to the MyReview system lets unintended users download these documents. This information leakage can be used to illegally retrieve sensitive or licensed documents. I. Description The MyReview web application is an...

CVE-2006-4957

SQL injection vulnerability in the GetMember function in functions.php in MyReview 1.9.4 allows remote attackers to execute arbitrary SQL commands via the email parameter to Admin.php...

CVE-2006-4957

CVE-2006-4957 corresponds to a SQL injection in MyReview 1.9.4. The GetMember function in functions.php fails to sanitize the email parameter used by Admin.php, enabling remote attackers to execute arbitrary SQL. Exploitation details are supported by multiple sources (NVD/Nessus references). The ...

CVE-2006-4957

SQL injection vulnerability in the GetMember function in functions.php in MyReview 1.9.4 allows remote attackers to execute arbitrary SQL commands via the email parameter to Admin.php...

MyReview 1.9.4 (email) Remote SQL Injection / Code Execution Exploit

Exploit for unknown platform in category web applications ==================================================================== MyReview 1.9.4 email Remote SQL Injection / Code Execution Exploit ==================================================================== MyReview 1.9.4 SQL Injection explo...

MyReview 1.9.4 - email SQL Injection Code Execution

MyReview 1.9.4 - email SQL Injection Code Execution MyReview 1.9.4 SQL Injection exploit http://myreview.lri.fr/ in functions.php starting from line 382 ............ function GetMember $email, $db, $mode="array" $query = "SELECT FROM PCMember WHERE email = '$email'" ; result = $db-execRequete...

MyReview 1.9.4 - 'email' SQL Injection / Code Execution

MyReview 1.9.4 SQL Injection exploit http://myreview.lri.fr/ in functions.php starting from line 382 ............ function GetMember $email, $db, $mode="array" $query = "SELECT FROM PCMember WHERE email = '$email'" ; result = $db-execRequete $query; .......... $email is not checked before used in...

MyReview 1.9.4 (email) Remote SQL Injection / Code Execution Exploit

No description provided by source. MyReview 1.9.4 SQL Injection exploit http://myreview.lri.fr/ in functions.php starting from line 382 ............ function GetMember $email, $db, $mode="array" $query = "SELECT FROM PCMember WHERE email = '$email'" ; result = $db-execRequete $query;...

MyReview Admin.php email Parameter SQL Injection

The remote host is running MyReview, an open source paper submission and review web application. The version of MyReview installed on the remote host fails to properly sanitize input to the 'email' parameter before using it in the 'GetMember' function in a database query. Regardless of PHP's...