Description
Multiple SQL injection vulnerabilities in ChurchInfo allow remote attackers to execute arbitrary SQL commands via the PersonID parameter to (1) PersonView.php, (2) MemberRoleChange.php, (3) PropertyAssign.php, (4) WhyCameEditor.php, (5) GroupPropsEditor.php, (6) Reports/PDFLabel.php, or (7) UserDelete.php, (8) DepositSlipID parameter to DepositSlipEditor.php, (9) QueryID parameter to QueryView.php, GroupID parameter to (10) GroupView.php, (11) GroupMemberList.php, (12) MemberRoleChange.php, (13) GroupDelete.php, (14) /Reports/ClassAttendance.php, or (15) /Reports/GroupReport.php, (16) PropertyID parameter to PropertyEditor.php, FamilyID parameter to (17) Canvas05Editor.php, (18) CanvasEditor.php, or (19) FamilyView.php, or (20) PledgeID parameter to PledgeDetails.php.
References
- 18416 vdb-entry
- 18411 vdb-entry
- 18423 vdb-entry
- 20050801 ChurchInfo Multiple Vulnerabilities mailing-list
- 18421 vdb-entry
- 18418 vdb-entry
- 18413 vdb-entry
- 14438 vdb-entry
- 18417 vdb-entry
- 1014617 vdb-entry
- 18420 vdb-entry
- 18415 vdb-entry
- 18428 vdb-entry
- 18414 vdb-entry
- 18427 vdb-entry
- 18422 vdb-entry
- 18410 vdb-entry
- 18412 vdb-entry
- 18408 vdb-entry
- 18424 vdb-entry
- 18409 vdb-entry
- churchinfo-sql-injection(21647) vdb-entry
- 18419 vdb-entry
- 16292 third-party-advisory