CVE-2014-100020

CVE-2014-100020 describes an SQL injection in ChangeEmail.php of iTechClassifieds 3.03.057, allowing remote attackers to execute arbitrary SQL commands via the PreviewNum parameter. The CatID parameter vulnerability is noted as covered by a separate CVE (CVE-2008-0685). The provided documents con...

CVE-2008-0685

The CVE-2008-0685 entry concerns a SQL injection in ViewCat.php of iTechClassifieds 3.0, exploitable via the CatID parameter to yield arbitrary SQL commands on the backend. Affected component is the ViewCat.php code path in iTechClassifieds 3.0, with the underlying issue being improper handling o...

CVE-2008-0684

CVE-2008-0684 documents a cross-site scripting (XSS) vulnerability in ViewCat.php of iTechClassifieds 3.0, exploitable via the CatID parameter to inject arbitrary web script/HTML. The root cause is lack of proper input validation/sanitization in Category ID handling, allowing attacker-supplied in...