Description
Multiple SQL injection vulnerabilities in SocialEngine (SE) before 2.83 allow remote attackers to execute arbitrary SQL commands via (1) an se_user cookie to include/class_user.php or (2) an se_admin cookie to include/class_admin.php.
References
- 20080722 Vulnerability: SocialEngine (SocialEngine.net) high risk security flaw mailing-list
- socialengine-cookie-sql-injection(43958) vdb-entry
- http://www.socialengine.net/news.php
- 4035 third-party-advisory
- 30342 vdb-entry
- 31203 third-party-advisory