CVE-2005-0669 Information

Description

Multiple SQL injection vulnerabilities in mod.php for phpCOIN 1.2.0 through 1.2.1b allow remote attackers to execute arbitrary SQL commands via the (1) the faq_id in the faq mod (2) the id parameter in the pages mod (3) the id parameter in the siteinfo module (4) the topic_id parameter in the articles module (5) the ord_id in the orders module (6) the dom_id parameter in the domains module or (7) the invd_id parameter in the invoices module.

Reference

http://forums.phpcoin.com/index.php?showtopic=4101 http://forums.phpcoin.com/index.php?showtopic=4116 http://forums.phpcoin.com/index.php?showtopic=4118 http://lostmon.blogspot.com/2005/03/phpcoin-posible-sql-injection-comands.html http://secunia.com/advisories/14439 http://securitytracker.com/id?1013329 http://www.securityfocus.com/bid/12686 https://exchange.xforce.ibmcloud.com/vulnerabilities/19571