EUVD-2008-2673

Malware in sbrugna...

CVE-2008-2678: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Telephone Directory 2008, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 code parameter in a confirmdata action to edit1.php and the 2 id parameter to viewmore.php...