Description

SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter.

Remediation

References

CVE-2012-5910

Related Vulnerabilities

IBMHttpServer Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-1360)

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-5868)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Arbitrary File Deletion (1.0.78)

Microsoft SQL Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2007-5090)

SugarCRM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-2045)

Severity

Medium

Classification

CVE-2012-5910 CWE-138

Tags

Missing Update Known Vulnerabilities