Gentoo: 'phpwebsite' SQL injection vulnerability
phpwebsite contains an sql injection vulnerability in the calendarmodule which allows the attacker to execute sql queries.
Summary
- - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200309-03 - - ---------------------------------------------------------------------
- - ---------------------------------------------------------------------
phpwebsite contains an sql injection vulnerability in the calendar module which allows the attacker to execute sql queries.
In addition phpwebsite is also vulnerable to XSS, more information can be found in the full advisory.
Read the full advisory at: http://marc.theaimsgroup.com/?l=bugtraq&m=106062021711496&w=2
SOLUTION
It is recommended that all Gentoo Linux users who are running net-www/phpwebsite upgrade to phpwebsite-0.9.3_p1 as follows:
emerge sync emerge phpwebsite emerge clean
- - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at - - ---------------------------------------------------------------------
Resolution
References
Availability
Concerns
Severity
PACKAGE : phpwebsite
SUMMARY : SQL Injection, DoS and XSS Vulnerabilities
DATE : 2003-09-02 08:54 UTC
EXPLOIT : remote
VERSIONS AFFECTED : =phpwebsite-0.9.3_p1
CVE :
Background
