EUVD-2012-3433

Malware in sbrugna...

NeoInvoice Blind SQL Injection (CVE-2012-3477)

NeoInvoice is a multi-tenant open source invoicing system, that currently contains an unauthenticated blind SQL injection condition in signupcheck.php. The input for the value field isn't being properly sanitized, and is used in string concatenation to create the SQL query. See here for the...

CVE-2012-3477

SQL injection vulnerability in signupcheck.php in NeoInvoice allows remote attackers to execute arbitrary SQL commands via the value parameter in a username action...

CVE-2012-3477

CVE-2012-3477 affects NeoInvoice via an unauthenticated blind SQL injection in signup_check.php where the value parameter of the username action is concatenated into an SQL query. The vulnerability allows remote attackers to run arbitrary SQL commands; the PoC shows a value parameter crafted to t...