EUVD-2007-0525

Malware in sbrugna...

CVE-2007-0527: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the isremembered function in class.login.php in Website Baker 2.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the REMEMBERKEY cookie parameter. NOTE: some of these details are obtained from third party information...

Website Baker REMEMBER_KEY Cookie SQL Injection

The remote host is running Website Baker, a PHP-based content management system. The installed version of Website Baker fails to validate input to the 'REMEMBERKEY' cookie before using it in 'framework/class.login.php' to construct SQL queries. Provided PHP's 'magicquotesgpc' setting is disabled,...