CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 7.5
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: multiple sql injection vulnerabilities in a really simple chat (arsc) 3.3-rc2 allow remote attackers to execute arbitrary sql commands via the (1) arsc_user parameter to base/admin/edit_user.php, (2) arsc_layout_id parameter in base/admin/edit_layout.php, or (3) arsc_room parameter to base/admin/edit_room.php.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2011-06-29
Last Modified Date: 2011-06-30