Description
SQL injection vulnerability in tForum 2.00 in the Raymond BERTHOU script collection (aka RBL - ASP) allows remote attackers to execute arbitrary SQL commands via the (1) id and (2) pass to user_confirm.asp.
References
- 22350 vdb-entry
- 20070127 RBL - ASP (scripts with db) SQL injection mailing-list
- http://forums.avenir-geopolitique.net/viewtopic.php?t=2607
- 2201 third-party-advisory
- rbl-userpass-sql-injection(31927) vdb-entry
- 36040 vdb-entry
- 20070131 Partial source code verify - "RBL - ASP" scripts SQL injection mailing-list
- 20070129 RBL - ASP (scripts with db) SQL injection mailing-list