Description
SQL injection vulnerability in files.asp in OfficeFlow 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the Project parameter.
References
- http://pridels0.blogspot.com/2006/06/officeflow-26-vuln.html
- officeflow-files-sql-injection(27023) vdb-entry
- 20545 third-party-advisory
- 18367 vdb-entry
- 1016255 vdb-entry
- ADV-2006-2246 vdb-entry