Sql injection

Multiple SQL injection vulnerabilities in RoomPHPlanning 1.6 allow remote attackers to execute arbitrary SQL commands via 1 the loginus parameter to Login.php or 2 the Old Password field to changepwd.php, and allow 3 remote authenticated administrators to execute arbitrary SQL commands via the id...

CVE-2008-2488

admin/userform.php in RoomPHPlanning 1.5 does not require administrative credentials, which allows remote authenticated users to create new admin accounts...

CVE-2008-2488

CVE-2008-2488 affects RoomPHPlanning 1.5. The issue is in admin/userform.php, where no administrative credentials are required, allowing remote authenticated users to create new admin accounts. This is the root cause and directly leads to privilege escalation within the application. The available...