CVE-2006-4141 SQL injection vulnerability in news.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) sortby and (2) sortorder parameters.
HighCVSS 7.5
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in news.php in Virtual War (VWar) 1.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) sortby and (2) sortorder parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vwar virtual war | <= 1.5.0 | No fix listed |
References
- 1383 third-party-advisory
- 20060809 Virtual War v1.5.0 <= Sql Injection vuln. mailing-list
- virtualwar-news-sql-injection(28332) vdb-entry