Description
SQL injection vulnerability in phpBannerExchange before 2.0 Update 6 allows remote attackers to execute arbitrary SQL commands via the (1) login parameter in (a) client/stats.php and (b) admin/stats.php, or the (2) pass parameter in client/stats.php.
References
- phpbannerexchange-stats-sql-injection(27195) vdb-entry
- 18448 vdb-entry
- 26510 vdb-entry
- http://www.eschew.net/scripts/phpbe/2.0/releasenotes.php
- http://www.redteam-pentesting.de/advisories/rt-sa-2006-004.txt
- 20060615 Advisory: Authentication bypass in phpBannerExchange mailing-list
- ADV-2006-2402 vdb-entry
- 20060615 Advisory: Authentication bypass in phpBannerExchange mailing-list