Description
SQL injection vulnerability in KBase Express 1.0.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) id parameter to category.php and (2) search parameters to search.php.
References
- 21340 vdb-entry
- ADV-2005-2641 vdb-entry
- 17806 third-party-advisory
- 21341 vdb-entry
- kbaseexpress-multiple-sql-injection(23309) vdb-entry
- 15635 vdb-entry
- http://pridels0.blogspot.com/2005/11/kbase-express-sql-inj-vuln.html