Description
Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) passw parameters to (a) cn_auth.php, (3) s parameter to (b) news.php, or (4) a parameter to (c) dpost.php.
References
- 1015957 vdb-entry
- 24383 vdb-entry
- ADV-2006-1237 vdb-entry
- czarnews-multiple-sql-injection(25624) vdb-entry
- http://evuln.com/vulns/118/summary.html
- 19541 third-party-advisory
- 20060417 [eVuln] CzarNews XSS and Multiple SQL Injection Vulnerabilities mailing-list
- 17380 vdb-entry
- 24382 vdb-entry
- 24384 vdb-entry