Description
SQL injection vulnerability in the is_remembered function in class.login.php in Website Baker 2.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the REMEMBER_KEY cookie parameter. NOTE: some of these details are obtained from third party information.
References
- 23828 third-party-advisory
- 2185 third-party-advisory
- ADV-2007-0311 vdb-entry
- 32945 vdb-entry
- websitebaker-login-sql-injection(31692) vdb-entry
- 22176 vdb-entry
- 20070122 SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before mailing-list