Description
Multiple "potential" SQL injection vulnerabilities in Utopia News Pro (UNP) 1.1.4 might allow remote attackers to execute arbitrary SQL commands via (1) the newsid parameter in editnews.php, (2) the catid and question parameters in faq.php, (3) the poster parameter in postnews.php, (4) the tempid parameter in templates.php, and (5) the userid and groupid parameters in users.php.
References
- 20051211 [PHP-CHECKER] 99 potential SQL injection vulnerabilities mailing-list
- 21649 vdb-entry
- ADV-2005-2859 vdb-entry
- http://glide.stanford.edu/yichen/research/sec.pdf
- 17988 third-party-advisory
- 20051212 [PHP-CHECKER] 99 potential SQL injection vulnerabilities mailing-list
- 21647 vdb-entry
- 21648 vdb-entry
- 21645 vdb-entry
- 21646 vdb-entry
- utopianewspro-editnews-sql-injection(23564) vdb-entry