[VIM] @1 File Store PRO SQL injection - the old gray dupe

[Steven M. Christey]

from 2008: http://www.milw0rm.com/exploits/6040

These vectors for the id parameter in config.php and download.php were
also disclosed by eVuln in 2006, albeit for a different version (version
2006.03.07, non-pro).  See CVE-2006-1278.

- Steve

======================================================
Name: CVE-2006-1278
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1278
Reference: BUGTRAQ:20060324 [eVuln] @1 File Store Multiple XSS and SQL Injection Vulnerabilities
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/428659/100/0/threaded
Reference: MISC:http://evuln.com/vulns/95/summary.html
Reference: BID:17090
Reference: URL:http://www.securityfocus.com/bid/17090
Reference: VUPEN:ADV-2006-0943
Reference: URL:http://www.frsirt.com/english/advisories/2006/0943
Reference: OSVDB:23851
Reference: URL:http://www.osvdb.org/23851
Reference: OSVDB:23852
Reference: URL:http://www.osvdb.org/23852
Reference: OSVDB:23853
Reference: URL:http://www.osvdb.org/23853
Reference: OSVDB:23854
Reference: URL:http://www.osvdb.org/23854
Reference: OSVDB:23855
Reference: URL:http://www.osvdb.org/23855
Reference: OSVDB:23856
Reference: URL:http://www.osvdb.org/23856
Reference: OSVDB:23857
Reference: URL:http://www.osvdb.org/23857
Reference: OSVDB:23858
Reference: URL:http://www.osvdb.org/23858
Reference: OSVDB:23859
Reference: URL:http://www.osvdb.org/23859
Reference: OSVDB:23860
Reference: URL:http://www.osvdb.org/23860
Reference: OSVDB:23861
Reference: URL:http://www.osvdb.org/23861
Reference: OSVDB:23862
Reference: URL:http://www.osvdb.org/23862
Reference: OSVDB:23863
Reference: URL:http://www.osvdb.org/23863
Reference: OSVDB:23864
Reference: URL:http://www.osvdb.org/23864
Reference: OSVDB:24106
Reference: URL:http://www.osvdb.org/24106
Reference: SECTRACK:1015826
Reference: URL:http://securitytracker.com/id?1015826
Reference: SECUNIA:19224
Reference: URL:http://secunia.com/advisories/19224
Reference: SREASON:619
Reference: URL:http://securityreason.com/securityalert/619
Reference: XF:filestore-multiple-sql-injection(25183)
Reference: URL:http://xforce.iss.net/xforce/xfdb/25183

SQL injection vulnerability in @1 File Store 2006.03.07 allows remote
attackers to execute arbitrary SQL commands via the id parameter to
(1) functions.php and (2) user.php in the libs directory, (3) edit.php
and (4) delete.php in control/files/, (5) edit.php and (6) delete.php
in control/users/, (7) edit.php, (8) access.php, and (9) in
control/folders/, (10) access.php and (11) delete.php in
control/groups/, (12) confirm.php, and (13) download.php; (14) the
email parameter in password.php, and (15) the id parameter in
folder.php.