Description
SQL injection vulnerability in login.asp for tPassword in the Raymond BERTHOU script collection (aka RBL - ASP) allows remote attackers to execute arbitrary SQL commands via the (1) User and (2) Password parameters.
References
- 20070127 RBL - ASP (scripts with db) SQL injection mailing-list
- http://forums.avenir-geopolitique.net/viewtopic.php?t=2607
- 20070131 Partial source code verify - "RBL - ASP" scripts SQL injection mailing-list
- 2225 third-party-advisory
- 20070129 RBL - ASP (scripts with db) SQL injection mailing-list