PT-2014-2641

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 4.1.7 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the show statuses parameter in the "blogs/admin.php" endpoint. This can be leveraged using CSRF to enabl...

PT-2014-3385

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 4.1.7 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the show statuses parameter...