Knockout

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `shopid` parameter in a "view" action, specifically targeting the shop.php file.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `makale id` parameter in the oku.asp file.

The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the `username` and `password` parameters to "authenticate.php" and the `ID` parameter to "pwn.php" when magic quotes gpc is disabled.

The issue concerns multiple SQL injection vulnerabilities in the log-in form. These vulnerabilities allow remote attackers to execute arbitrary SQL commands by manipulating the `Username` and `Password` fields in the log-in form.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the `ID` parameter in the "detail.asp" page.

The issue allows remote attackers to execute arbitrary SQL commands. This is possible via the `id` and `password` (`pw`) parameters to "admin.php" or "user.php" API endpoints.

The issue allows remote attackers to bypass authentication and gain administrative access. This is achieved by setting the `kulladi` cookie to a valid username, exploiting the `uye paneli.php` file in phPortal.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `sayfa` parameter in the "default.asp" file.

The issue allows remote attackers to update a file or have unspecified other impact via a direct request to "upgrade.asp" without requiring administrative authentication.

The issue allows remote attackers to download a database due to insufficient access control of sensitive information stored under the web root. This can be achieved via a direct request to "Db/urun.mdb".

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `item` parameter in the "index.asp" file.

The issue allows remote attackers to include and execute arbitrary local files. This is achieved by exploiting directory traversal vulnerabilities using a .. (dot dot) in the `class` parameter to "include/functions.inc.php" and the `file` parameter to "include/common.inc.php".

The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the `language` parameter in the "login.php" file.

The issue allows remote attackers to execute arbitrary PHP code via a URL in the `loadadminpage` parameter in the admin/frontpage right.php file.