CVE-2015-1428

Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow 1 remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or 2 remote authenticated users to execute arbitrary SQL commands via the valueid parameter in a savevalue action to...

CVE-2015-1428: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow 1 remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or 2 remote authenticated users to execute arbitrary SQL commands via the valueid parameter in a savevalue action to...

PT-2015-5281

Name of the Vulnerable Software and Affected Versions Sefrengo versions prior to 1.6.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to "backend/main.php" or remote authenticated users to execute arbitrary SQL commands via the...