Description
SQL injection vulnerability in the (1) announce and (2) notes modules of phpWebSite before 0.9.3-2 allows remote attackers to execute arbitrary SQL queries, as demonstrated using the ANN_id parameter to the announce module.
References
- 10878 third-party-advisory
- phpwebsite-announce-sql-injection(15219) vdb-entry
- http://www.systemsecure.org/advisories/ssadvisory13022004.php
- http://www.zone-h.com/advisories/read/id=3955
- 1009045 vdb-entry
- http://sourceforge.net/tracker/index.php?func=detail&aid=892174&group_id=15539&atid=115539
- 3852 vdb-entry