Description
Multiple SQL injection vulnerabilities in BaalAsp forum allow remote attackers to execute arbitrary SQL commands via the (1) password parameter to (a) adminlogin.asp, the (2) name or (3) password parameter to (b) userlogin.asp, or the (3) search parameter to search.asp.
References
- 21111 vdb-entry
- 20061115 BaalAsp forum [login bypass ,injections sql(post), xss(post)] mailing-list
- 22943 third-party-advisory
- baalasp-search-sql-injection(30343) vdb-entry
- http://s-a-p.ca/index.php?page=OurAdvisories&id=35
- 1913 third-party-advisory
- baalasp-login-security-bypass(30342) vdb-entry
- ADV-2006-4579 vdb-entry