CVE-2005-3236: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Cyphor 0.19 allow remote attackers to execute arbitrary SQL and obtain administrative access via 1 the fid parameter of newmsg.php, which can enable XSS attacks when the SQL syntax is invalid or 2 the nick parameter of lostpwd.php...