CVE-2009-3217

CVE-2009-3217 describes an SQL injection in the admin module of iWiccle 1.01. The vulnerability occurs in the edit_user action (index.php) via the member_id parameter, due to unsafe SQL handling in the admin code, enabling remote attackers to execute arbitrary SQL commands. The CVSSv2 base score ...

CVE-2009-3216

CVE-2009-3216 describes multiple directory traversal vulnerabilities in iWiccle 1.01 . When magic_quotes_gpc is disabled, remote attackers can read arbitrary files by supplying a .. sequence in either the show parameter of the admin module (accessed via index.php) or the module parameter of index...