Description
Multiple SQL injection vulnerabilities in SelectaPix 1.31 allow remote attackers to execute arbitrary SQL commands via the (1) albumID parameter to (a) view_album.php or (b) index.php, (2) imageID parameter to (c) popup.php, or (3) username and (4) password parameters to (d) admin/member.php.
References
- ADV-2006-2232 vdb-entry
- 20134 third-party-advisory
- 18349 vdb-entry
- 26243 vdb-entry
- 1016256 vdb-entry
- http://secunia.com/secunia_research/2006-39/advisory/
- 20060609 Secunia Research: SelectaPix Cross-Site Scripting and SQLInjection Vulnerabilities mailing-list
- 26244 vdb-entry
- 26246 vdb-entry
- 26245 vdb-entry
- selectapix-multiple-scripts-sql0injection(27013) vdb-entry