Description
SQL injection vulnerability in admin/editer.php in Tr Forum 2.0 allows remote authenticated users to execute arbitrary SQL commands via the id2 parameter. NOTE: this can be leveraged with other Tr Forum vulnerabilities to allow unauthenticated attackers to gain privileges.
References
- 1508 third-party-advisory
- 20060903 Tr Forum V2.0 Multiple Vulnerabilities mailing-list
- tr-forum-admin-sql-injection(28753) vdb-entry
- ADV-2006-3452 vdb-entry
- 21754 third-party-advisory
- 28545 vdb-entry
- 19834 vdb-entry
- 2297 exploit
- http://acid-root.new.fr/poc/10060903.txt
- 1016788 vdb-entry