CVE-2010-4784

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Easy Banner 2009.05.18 - '/member.php' Multiple SQL Injection / Authentication Bypass2010-11-26 · webapps · php · Verified

Impact

Multiple SQL injection vulnerabilities in member.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://evuln.com/vulns/147/summary.html
• http://packetstormsecurity.org/files/view/96153/easybannerfree-sql.txt
• http://secunia.com/advisories/42316
• http://securityreason.com/securityalert/8184
• http://www.osvdb.org/69511
• http://www.securityfocus.com/archive/1/514908/100/0/threaded
• http://www.securityfocus.com/bid/45066
• http://evuln.com/vulns/147/summary.html
• http://packetstormsecurity.org/files/view/96153/easybannerfree-sql.txt
• http://secunia.com/advisories/42316
• http://securityreason.com/securityalert/8184
• http://www.osvdb.org/69511
• http://www.securityfocus.com/archive/1/514908/100/0/threaded
• http://www.securityfocus.com/bid/45066