CVE-2011-5039 Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to login.php, (3) the filte...
HighCVSS 7.5
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to login.php, (3) the filter parameter to widget.dokumenti_lista.php, and (4) the fin_nalog_id parameter to nalozi_naslov.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| infoproject biznis heroj | All versions | No fix listed |
References
- 18259 exploit
- www.zeroscience.mk exploit
- www.zeroscience.mk
- infoproject-multiple-sql-injection(71927) vdb-entry