CWE Code: 89
Vulnerability Type: sql_injection
CVSS Score: 6.8
CWE Name:  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Summary: sql injection vulnerability in categorydetail.php in article friendly standard allows remote attackers to execute arbitrary sql commands via the cat parameter. regarding access complexity:

http://secunia.com/advisories/31292:

"input passed to the "autid" parameter in authordetail.php and to the "cat" parameter in categorydetail.php is not properly sanitised before being used in sql queries. this can be exploited to manipulate sql queries by injecting arbitrary sql code.

successful exploitation requires that "magic_quotes_gpc" is disabled."
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2008-08-13
Last Modified Date: 2017-09-29