CVE-2008-4877

CVE-2008-4877 describes a SQL injection in WebCards 1.3, specifically in admin.php, exploitable when magic_quotes_gpc is disabled. The vulnerability allows remote attackers to manipulate the underlying SQL via the user parameter, potentially causing arbitrary SQL execution. This is documented acr...

CVE-2008-4878

The CVE-2008-4878 entry concerns WebCards 1.3, specifically the Add Image Macro feature. The vulnerability is an unrestricted file upload that enables remote authenticated administrators to execute arbitrary code by uploading a file with an executable extension and then requesting the uploaded fi...