NuytsTech Security

CVE-2009-4796

by ·

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order and (2) direction parameters to search.php.

Date published : 2010-04-22

http://www.securityfocus.com/bid/34281

http://www.securityfocus.com/archive/1/502260/100/0/threaded

Tags: