Description
SQL injection vulnerability in the forget password section (LostPwd.asp) in Eagle Software Aeries Browser Interface (ABI) 3.7.9.17 allows remote attackers to execute arbitrary SQL commands via the EmailAddress parameter. NOTE: some of these details are obtained from third party information.
References
- 20071220 [Aria-Security.net] ABI Version 3.7.9.17 Remote SQL Injection mailing-list
- ADV-2007-4302 vdb-entry
- 28193 third-party-advisory
- http://aria-security.net/forum/showthread.php?p=1174
- 39383 vdb-entry
- aeries-lostpwd-sql-injection(39176) vdb-entry
- 26962 vdb-entry