high7.5
CVE-2005-4137
SQL injection vulnerability in viewinvoice.php in DRZES HMS 3.2 allows remote attackers to execute arbitrary SQL commands via the invoiceID parameter.
Impact
SQL injection vulnerability in viewinvoice.php in DRZES HMS 3.2 allows remote attackers to execute arbitrary SQL commands via the invoiceID parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fad Solutions | Drzes Hms | Version 3.2 |
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/17755
- http://securitytracker.com/id?1015334
- http://www.osvdb.org/21180
- http://www.securityfocus.com/archive/1/418851/100/0/threaded
- http://www.securityfocus.com/bid/15766
- http://www.vupen.com/english/advisories/2005/2633
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23264
- http://secunia.com/advisories/17755
- http://securitytracker.com/id?1015334
- http://www.osvdb.org/21180
- http://www.securityfocus.com/archive/1/418851/100/0/threaded
- http://www.securityfocus.com/bid/15766
- http://www.vupen.com/english/advisories/2005/2633
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23264