Description
SQL injection vulnerability in login.php in the GUI management console in Symantec Web Gateway 4.5 before 4.5.0.376 allows remote attackers to execute arbitrary SQL commands via the USERNAME parameter.
References
- http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2011&suid=20110112_00
- 45742 vdb-entry
- ADV-2011-0088 vdb-entry
- symantec-web-username-sql-injection(64658) vdb-entry
- 42878 third-party-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-11-013/
- 70415 vdb-entry
- 1024958 vdb-entry