Behrooz_Ice
03-03-2004, 04:24 PM
This time we discovered three new holes. That ranges from extracting information to deleting information and files in the remote web server. This hole is located in the ModifyMessage function. In this function the parameter $msg isn't checked against malicious input, so it's possible to inject SQL. Enjoy!