Description
Multiple SQL injection vulnerabilities in lib-sessions.inc.php in phpAdsNew and phpPgAds 2.0.6 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the sessionID parameter in (1) logout.php and (2) index.php.
References
- http://www.fitsec.com/advisories/FS-05-01.txt
- 172 third-party-advisory
- 20051110 [FS-05-01] Multiple vulnerabilities in phpAdsNew mailing-list
- 17464 third-party-advisory
- http://sourceforge.net/project/shownotes.php?group_id=36679&release_id=370942
- 20745 vdb-entry
- 20744 vdb-entry
- phpadsnew-logout-sql-injection(23044) vdb-entry
- 20051115 [PHPADSNEW-SA-2005-002] phpAdsNew and phpPgAds 2.0.7 fix multiple vulnerabilities mailing-list
- 171 third-party-advisory
- 15385 vdb-entry
- http://www.zone-h.org/en/advisories/read/id=8413/
- 1015193 vdb-entry
- 17579 third-party-advisory
- ADV-2005-2380 vdb-entry