Description
SQL injection vulnerability in PHPKit 1.6.1 RC2 allows remote attackers to inject arbitrary SQL commands via the catid parameter to include.php when the path parameter is set to faq/faq.php, and other unspecified vectors involving guestbook/print.php.
References
- 20061110 PHPKit 1.6.1 RC2 (faq/faq.php) Remote SQL Injection Exploit mailing-list
- 21002 vdb-entry
- phpkit-faq-sql-injection(30209) vdb-entry
- 31265 vdb-entry
- http://www.bb-pcsecurity.de/websecurity/532/org/PHPKit_1.6.1_RC2_%28faq-faq.php%29_Remote_SQL_Injection_Exploit.htm
- 17479 third-party-advisory
- 2357 third-party-advisory