Description
search.php in w-Agora (Web-Agora) allows remote attackers to obtain potentially sensitive information via a ' (quote) value followed by certain SQL sequences in the (1) search_forum or (2) search_user parameter, which force a SQL error.
References
- wagora-search-sql-injection(33177) vdb-entry
- 20070320 w-agora [multiples file upload,xss,full path disclosure,error sql] mailing-list
- 2462 third-party-advisory
- 24605 third-party-advisory
- 23057 vdb-entry
- 34376 vdb-entry