Description
Multiple SQL injection vulnerabilities in war.php in Virtual War (VWar) 1.5.0 R14 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) s, (2) showgame, (3) sortorder, and (4) sortby parameters.
References
- 20060814 Virtual War v1.5.0 SQL injection and XSS mailing-list
- 20080213 Re: Vwar New Bug mailing-list
- virtualwar-war-sql-injection(27153) vdb-entry
- http://pridels0.blogspot.com/2006/06/virtual-war-multiple-sql-inj-vuln.html
- 20696 third-party-advisory
- ADV-2006-2383 vdb-entry
- 20080213 Vwar New Bug mailing-list
- 26533 vdb-entry
- 27772 vdb-entry
- virtualwar-warphp-sql-injection(40481) vdb-entry