Description
Multiple SQL injection vulnerabilities in AspTopSites allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to goto.asp or (2) password parameter to includeloginuser.asp.
References
- http://www.exploitlabs.com/files/advisories/EXPL-A-2006-001-asptopsites.txt
- ADV-2006-0146 vdb-entry
- 22330 vdb-entry
- asptopsites-goto-sql-injection(24072) vdb-entry
- 18408 third-party-advisory
- 20060110 AspTopSites SQL injection mailing-list