Description
The Postaci frontend for PostgreSQL does not properly filter characters such as semicolons, which could allow remote attackers to execute arbitrary SQL queries via the deletecontact.php program.
References
- 20010117 Postaci allows arbitrary SQL query execution mailing-list
- 2230 vdb-entry
- postaci-sql-command-injection(5972) vdb-entry