medium6.5
CVE-2015-1434
Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter paramet…
Impact
Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mylittleforum | My Little Forum | through 2.3.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://mylittleforum.net/forum/index.php?id=8182
- http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html
- http://www.securityfocus.com/archive/1/534681/100/0/threaded
- http://www.securityfocus.com/bid/72575
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100855
- https://www.htbridge.com/advisory/HTB23248
- http://mylittleforum.net/forum/index.php?id=8182
- http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html
- http://www.securityfocus.com/archive/1/534681/100/0/threaded
- http://www.securityfocus.com/bid/72575
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100855
- https://www.htbridge.com/advisory/HTB23248