Description
SQL injection vulnerability in FlexCustomer 0.0.4 and earlier allows remote attackers to bypass authentication and execute arbitrary SQL commands via the admin and ordinary user interface, probably involving the (1) checkuser and (2) checkpass parameters to (a) admin/index.php, and (3) username and (4) password parameters to (b) index.php. NOTE: it was later reported that 0.0.6 is also affected.
References
- 25342 vdb-entry
- 858 third-party-advisory
- flexcustomer-usercheek-sql-injection(47651) vdb-entry
- 20060506 FlexCustomer <= 0.0.4 sql injection mailing-list
- 20016 third-party-advisory
- 17864 vdb-entry
- flexcustomer-login-sql-injection(26323) vdb-entry
- ADV-2006-1690 vdb-entry
- 25343 vdb-entry
- 7622 exploit