Description
Multiple SQL injection vulnerabilities in Netjuke 1.0-rc2 allow remote attackers to execute arbitrary SQL commands via (1) the ge_id parameter in a list.artists action to explore.php or (2) the id parameter in a show.tracks action to xml.php.
References
- 25600 vdb-entry
- 38834 vdb-entry
- 20070908 Netjuke 1.0-rc2 - sql injection & XSS mailing-list
- 3110 third-party-advisory
- netjuke-explore-xml-sql-injection(36516) vdb-entry
- 38833 vdb-entry