Description
Multiple SQL injection vulnerabilities in Wordcircle 2.17 allow remote attackers to (1) execute arbitrary SQL commands and bypass authentication via the password field in the login action to index.php (involving v_login.php and s_user.php) and (2) have other unknown impact via certain other fields in unspecified scripts.
References
- ADV-2006-0185 vdb-entry
- 346 third-party-advisory
- http://evuln.com/vulns/27/summary.html
- 345 third-party-advisory
- 20060112 [eVuln] Wordcircle Authentication Bypass mailing-list
- 18440 third-party-advisory
- 16227 vdb-entry
- 22358 vdb-entry
- http://evuln.com/vulns/28/summary.html
- 20060112 [eVuln] Wordcircle Multiple SQL Injection & XSS Vulnerabilities mailing-list
- wordcircle-sql-injection(24105) vdb-entry
- wordcircle-login-security-bypass(24108) vdb-entry