Description
SQL injection vulnerability in edituser.php in Xoops before 2.0.15 allows remote attackers to execute arbitrary SQL commands via the user_avatar parameter.
References
- xoops-edituser-sql-injection(28586) vdb-entry
- 28265 vdb-entry
- http://devteam.xoops.org/releases/changelog-2.0.15.html
- 19720 vdb-entry
- 20060825 Sql injection in Xoops mailing-list
- http://www.hackers.ir/advisories/xoops.html
- 21643 third-party-advisory
- ADV-2006-3402 vdb-entry
- 1461 third-party-advisory