Description
Multiple SQL injection vulnerabilities in an unspecified BPG-InfoTech Content Management System product allow remote attackers to execute arbitrary SQL commands via the (1) vjob parameter in publications_list.asp or (2) InfoID parameter in publication_view.asp.
References
- 20061114 BPG Content Management System SQL Injection mailing-list
- 1915 third-party-advisory
- http://aria-security.net/advisory/bpg.txt