Description
IBM Informix Web DataBlade 4.12 unescapes user input even if an application has escaped it, which could allow remote attackers to execute SQL code in a web form even when the developer has attempted to escape it.
References
- 4498 vdb-entry
- 20020411 IBM Informix Web DataBlade: Auto-decoding HTML entities mailing-list
- informix-wbm-sql-decoding(8827) vdb-entry