>> microBlog "month" and "year" Parameters SQL Injection Vulnerabilities
Title : microBlog "month" and "year" Parameters SQL Injection Vulnerabilities VUPEN ID : VUPEN/ADV-2006-0239 CVE ID : CVE-2006-0234
Rated as : Moderate Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2006-01-18
Technical Description
Two vulnerabilities were identified in microBlog, which could be exploited by remote attackers to execute arbitrary SQL commands. These flaws are due to input validation errors in the "index.php" script that does not properly validate the "month" and "year" parameters before being used in SQL statements, which may be exploited by malicious people to conduct SQL injection attacks.
