AdLogin.pm in AdCycle 1.15 and earlier allows remote attackers to bypass authentication and gain privileges by injecting SQL code in the $password argument.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Adcycle | Adcycle | 0.77 (including) | 0.77 (including) |
| Adcycle | Adcycle | 0.77b (including) | 0.77b (including) |
| Adcycle | Adcycle | 0.78b (including) | 0.78b (including) |
| Adcycle | Adcycle | 1.0 (including) | 1.0 (including) |
| Adcycle | Adcycle | 1.12 (including) | 1.12 (including) |
| Adcycle | Adcycle | 1.13 (including) | 1.13 (including) |
| Adcycle | Adcycle | 1.14 (including) | 1.14 (including) |
| Adcycle | Adcycle | 1.15 (including) | 1.15 (including) |
References
- http://archives.neohapsis.com/archives/bugtraq/2001-07/0249.html
- http://www.adcycle.com/cgi-bin/download.cgi?type=UNIX\u0026version=1.17
- http://www.securityfocus.com/bid/3032
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6837
- http://archives.neohapsis.com/archives/bugtraq/2001-07/0249.html
- http://www.adcycle.com/cgi-bin/download.cgi?type=UNIX\u0026version=1.17
- http://www.securityfocus.com/bid/3032
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6837