Description
Multiple SQL injection vulnerabilities in Xoops 2.0.16 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in kernel/group.php in core, (2) the lid parameter in class/table_broken.php in the Weblinks module, and other unspecified vectors.
References
- 20070204 Sql injection bugs in Xoops 2.0.16 + Weblinks module mailing-list
- 20070118 The vulnerabilities festival ! mailing-list
- 22399 vdb-entry
- 33684 vdb-entry
- 33685 vdb-entry
- http://www.hackers.ir/advisories/festival.txt