Description
SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the (1) a_name parameter or (2) user field of the login page.
References
- e107-resetcore-sql-injection(22780) vdb-entry
- 1015069 vdb-entry
- 20051018 e107 remote commands execution mailing-list
- 20070 vdb-entry
- 17237 third-party-advisory
- 15125 vdb-entry
- http://e107.org/news.php