Description
SQL injection vulnerability in search.php in PunBB before 1.2.14, when the PHP installation is vulnerable to CVE-2006-3017, allows remote attackers to execute arbitrary SQL commands via the result_list array parameter, which is not initialized.
References
- 1017131 vdb-entry
- 1824 third-party-advisory
- 20061030 Punbb <= 1.2.13 Multiple Vulnerabilities mailing-list
- ADV-2006-4256 vdb-entry
- http://www.wargan.org/index.php/2006/10/29/4-punbb-1213-multiple-vulnerabilities
- 30133 vdb-entry
- http://www.punbb.org/changelogs/1.2.13_to_1.2.14.txt