Description
SQL injection vulnerability in list.php in CityForFree indexcity 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cate_id parameter.
References
- indexcity-list-sql-injection(28507) vdb-entry
- 21565 third-party-advisory
- 19653 vdb-entry
- 28069 vdb-entry
- 20060912 [eVuln] indexcity SQL Injection and XSS Vulnerabilities mailing-list
- http://evuln.com/vulns/135/description.html