Description
Multiple SQL injection vulnerabilities in phpbb-Auction allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to auction_rating.php or (2) ar parameter to action_offer.php.
References
- http://www.snkenjoi.com/secadv/secadv9.txt
- 20060725 PHP-Auction SQL injection mailing-list
- 15704 vdb-entry
- 13283 vdb-entry
- 15705 vdb-entry
- http://www.phpbb-auction.com/sutra5600.html
- 15029 third-party-advisory
- http://www.aria-security.net/advisory/phpauction.txt
- 1013779 vdb-entry
- 13284 vdb-entry
- phpbb-auction-sql-injection(20203) vdb-entry