CVE-2011-5175
Banana Dance < 1.5 - SQL Injection via search.php Category Parameter
Title source: llmDescription
SQL injection vulnerability in search.php in Banana Dance, possibly B.1.5 and earlier, allows remote attackers to execute arbitrary SQL commands via the category parameter.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_misc
http://www.bananadance.org/Program-News/Minor-Update-and-New-Theme
Exploit x_refsource_misc
http://packetstormsecurity.org/files/115772/Banana-Dance-CMS-B.2.1-XSS-SQL-Injection.html
URL Repurposed x_refsource_confirm
http://www.doyoubananadance.com/Program-News/Important-Notice-About-SQLi-Exploit
Scores
EPSS
0.0131
EPSS Percentile
67.7%
Details
CWE
CWE-89
Status
published
Products (2)
bananadance/banana_dance
0.9 beta
bananadance/banana_dance
< 1.5
Published
Sep 15, 2012
Tracked Since
Feb 18, 2026