SECUNIA ADVISORY ID: SA23726

VERIFY ADVISORY: http://secunia.com/advisories/23726/

CRITICAL: Moderately critical

IMPACT: Manipulation of data

SOFTWARE: All In One Control Panel 1.x - http://secunia.com/product/12505/

DESCRIPTION: A vulnerability has been reported in All In One Control Panel (AIOCP), which can be exploited by malicious people to conduct SQL injection attacks. Input passed to the "download_category" parameter within shared/code/cp_functions_downloads.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerability is reported in versions prior to 1.3.009.

SOLUTION: Update to version 1.3.009.

PROVIDED AND/OR DISCOVERED BY: Reported by the vendor.

ORIGINAL ADVISORY: http://sourceforge.net/project/shownotes.php?release_id=477845