Lyris ListManager 5.0 up to and including 8.9a allows remote malicious users to add "ORDER BY" columns to SQL queries via unusual whitespace characters in the orderby parameter, such as (1) newlines and (2) 0xFF (ASCII 255) characters, which are interpreted as whitespace.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
lyris list manager 5.0 |
||
lyris list manager 6.0 |
||
lyris list manager 7.0 |
||
lyris list manager 8.0 |
||
lyris list manager 8.8a |