Multiple SQL injection vulnerabilities in phpYellowTM Pro Edition and Lite Edition 5.33 allow remote attackers to execute arbitrary SQL commands via the (1) haystack parameter t...
Date: 2005-12
Affected: phpyellow/phpyellowtm_lite, phpyellow/phpyellowtm_pro
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2005-4001
CVSS: 7.5 ()

Multiple SQL injection vulnerabilities in phpYellowTM Pro Edition and Lite Edition 5.33 allow remote attackers to execute arbitrary SQL commands via the (1) haystack parameter to search_result.php or (2) ckey parameter to print_me.php.


Mitigations:

Architectural layers (MAESTRO):