Critical · 9.8 CVE-2007-2534 EUVD-2007-2527GHSA-ch89-vv2m-5q5h

Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arbitrary SQL commands via the (1) ADMIN_U…

Published May 9, 2007 · Updated Sep 25, 2024 · Assigned by mitre

Description

Multiple SQL injection vulnerabilities in admin.php in phpHoo3 allow remote attackers to execute arbitrary SQL commands via the (1) ADMIN_USER (USER) and (2) ADMIN_PASS (PASS) parameters during a login. NOTE: CVE disputes this vulnerability, since ADMIN_USER/ADMIN_PASS are initialized before use

References

23854 vdb-entry
20070508 false: phpHoo3 Login SQL injection mailing-list
36180 vdb-entry
2669 third-party-advisory
20070506 phpHoo3 (admin.php) Remote Login Bypass SQL Injection Vulnerability mailing-list