CVE-2012-3477

CVE-2012-3477 affects NeoInvoice via an unauthenticated blind SQL injection in signup_check.php where the value parameter of the username action is concatenated into an SQL query. The vulnerability allows remote attackers to run arbitrary SQL commands; the PoC shows a value parameter crafted to t...

CVE-2012-4673

CVE-2012-4673 refers to a SQL injection vulnerability in NeoInvoice, specifically in application/controllers/invoice.php where the sort_col parameter in list_items can be manipulated to cause arbitrary SQL execution. This vulnerability is described as a separate issue from CVE-2012-3477. The link...