SQL injection vulnerability in auth.inc.php in PHPX 3.5.9 and earlier allows remote attackers to execute arbitrary SQL commands, bypass authentication, and upload arbitrary PHP code via the username parameter.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Phpx | Phpx | 3.5 (including) | 3.5 (including) |
| Phpx | Phpx | 3.5.1 (including) | 3.5.1 (including) |
| Phpx | Phpx | 3.5.2 (including) | 3.5.2 (including) |
| Phpx | Phpx | 3.5.3 (including) | 3.5.3 (including) |
| Phpx | Phpx | 3.5.4 (including) | 3.5.4 (including) |
| Phpx | Phpx | 3.5.5 (including) | 3.5.5 (including) |
| Phpx | Phpx | 3.5.6 (including) | 3.5.6 (including) |
| Phpx | Phpx | 3.5.7 (including) | 3.5.7 (including) |
| Phpx | Phpx | 3.5.8 (including) | 3.5.8 (including) |
| Phpx | Phpx | 3.5.9 (including) | 3.5.9 (including) |