CVE-2007-3520

CVE-2007-3520 describes a SQL injection in the Easybe 1-2-3 Music Store, via the parameter CategoryID in process.php, allowing remote attackers to execute arbitrary SQL commands. The root cause is unsafely handling the CategoryID input, enabling injected SQL through the web interface. Documented ...

CVE-2005-3855

Affected product/component : 1-2-3 music store, process.php .Vulnerability : SQL injection via the AlbumID parameter, allowing remote attackers to execute arbitrary SQL commands.Root cause (as described) : unsafely constructed SQL in the application logic.Impact (per sources) : remote command exe...