Description
Multiple SQL injection vulnerabilities in include.php in PHPKIT 1.6.1 R2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in conjunction with the login/userinfo.php path and (2) the session parameter (aka the PHPKITSID variable).
References
- 1015167 vdb-entry
- phpkit-userinfo-sql-injection(23010) vdb-entry
- 15354 vdb-entry
- 20560 vdb-entry
- 20051105 Advisory 21/2005: Multiple vulnerabilities in PHPKIT mailing-list
- ADV-2005-2344 vdb-entry
- 17479 third-party-advisory
- http://www.hardened-php.net/advisory_212005.80.html
- 20561 vdb-entry
- phpkit-phpkitsid-sql-injection(23013) vdb-entry