CVE-2006-0692

Description

Multiple SQL injection vulnerabilities in Carey Briggs PHP/MYSQL Timesheet 1 and 2 allow remote attackers to execute arbitrary SQL commands via the (1) yr, (2) month, (3) day, and (4) job parameters in (a) index.php and (b) changehrs.php.

Affected products

• carey_briggs / php_mysql_timesheet1 – 1
• carey_briggs / php_mysql_timesheet2 – 2

References

• MISChttp://www.securityfocus.com/bid/16620
• VENDOR_ADVISORYhttp://www.vupen.com/english/advisories/2006/0522
• VENDOR_ADVISORYhttp://secunia.com/advisories/18822
• MISChttp://securityreason.com/securityalert/451
• MISChttp://www.securityfocus.com/archive/1/425316/100/0/threaded
• MISChttp://www.evuln.com/vulns/67/summary.html
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/24567