Description
Multiple SQL injection vulnerabilities in CMS Mundo 1.0 build 008, and possibly other versions, allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter in the (a) news module, (2) searchstring parameter in (b) the search module, (3) id parameter in (c) the webshop module, (4) username parameter in (d) index.php, and (5) Name, (6) Address, (7) Zip, (8) City, (9) Country, and (10) Email fields during (e) a user profile update.
References
- http://secunia.com/secunia_research/2006-52/advisory/
- 20589 third-party-advisory
- 27143 vdb-entry
- 1236 third-party-advisory
- 27139 vdb-entry
- 27140 vdb-entry
- 27142 vdb-entry
- ADV-2006-2783 vdb-entry
- cmsmundo-index-sql-injection(27712) vdb-entry
- 27141 vdb-entry