HLDS WebMod 0.48 - Multiple Remote Vulnerabilities

Luigi Auriemma Application: WebMod http://www.djeyl.net/w.php Versions: = 0.48 Platforms: Windows and Linux Bugs: A directory traversal B Cookie buffer-overflow C parser.cpp arbitrary memory writing D scripts source disclosure Exploitation: remote Date: 03 May 2008 Author: Luigi Auriemma e-mail:...

ActualAnalyzer Lite style Parameter Traversal Local File Inclusion

The remote host is running ActualAnalyzer, a PHP-based tool for monitoring website traffic. The version of ActualAnalyzer installed on the remote host fails to sanitize user-supplied input to the 'style' parameter of the 'admin.php' script before using it to include PHP code. Regardless of PHP's...

Sun Java System Directory Server bind-dn Remote Privilege Escalation

The version of Sun Java System Directory Proxy Server running on the remote host is affected by an unauthorized access vulnerability. Specifically, the server fails to properly classify connections in relation to 'binddn' parameter. Successful exploitation of this issue might allow an unprivilege...

XOOPS Article Module article.php id Parameter SQL Injection

The remote host is running the Articles module, a third-party module for XOOPS. The version of this module installed on the remote host fails to properly sanitize user-supplied input to the 'id' parameter of the 'modules/articles/article.php' script before using it to build a database query...

WoltLab(R) Community Framework XSS and Full Path Disclosure Vulnerability

====================================================================== Advisory : WoltLabR Community Framework XSS and Full Path Disclosure Vulnerability Release Date : Application : WoltLabR Community Framework Version : WCF 1.0.6 and lower Platform : PHP Vendor URL : http://community.woltlab.co...

Custom Pages for Joomla! 'cpage' Parameter Local File Include

The version of the Custom Pages component for Joomla! running on the remote host is affected by a local file include vulnerability due to improper sanitization of user-supplied input to the 'cpage' parameter before using it in the custompages.php script to include PHP code. Regardless of the PHP...

VLC Media Player network/httpd.c httpd_FileCallBack Function Connection Parameter Format String

The remote host is running VLC, a popular media player application which can have an embedded web server. The remote version of this software is vulnerable to a format string attack when processing a malformed 'Connection:' http header. An attacker can exploit this flaw to execute arbitrary...

XOOPS Dictionary Module print.php id Parameter SQL Injection

The version of the Dictionary module for XOOPS installed on the remote host fails to sanitize user-supplied input to the 'id' parameter of the 'print.php' script before using it in a database query. Regardless of PHP's 'magicquotesgpc' setting, an attacker may be able to exploit this issue to...

PHPAuction Multiple Script include_path Parameter File Inclusion

The remote host is running PHPAuction, a PHP script for building auction websites. The version of PHPAuction installed on the remote host fails to sanitize input to the 'includepath' parameter of several scripts before using it to include PHP code. An unauthenticated, remote attacker can exploit...

netOffice Dwins demoSession Parameter Authentication Bypass

The remote host is running netOffice Dwins, an open source project management application written in PHP. The version of netOffice Dwins installed on the remote host allows an attacker to bypass authentication and access parts of the affected application to which access would not ordinarily be...

Centreon include/doc/get_image.php 'img' Parameter Traversal Arbitrary File Access

The remote host is running Centreon or Oreon, a web-based network supervision program based on Nagios. The version of Centreon / Oreon installed on the remote host fails to sanitize user-supplied input to the 'img' parameter of the 'include/doc/getimage.php' script before using it to display the...

Sniplets Plugin for WordPress execute.php 'text' Parameter Arbitrary Command Execution

The remote host is running Sniplets, a third-party text insertion plugin for WordPress. The version of Sniplets installed on the remote host passes user input to the 'text' parameter of the 'modules/execute.php' script before passing it to an 'eval' statement. Provided that PHP's 'registerglobals...

Mix Systems CMS (parent/id) Remote SQL Injection Exploit

No description provided by source. ? echo "\n"; echo "-------------------------Mix Systems CMS--------------------------"."\n"; echo "-----------------------coded by : halkfild------------------------"."\n"; echo "----------------------------antichat.ru------------------------"."\n"; if $argc!=4...

Cacti index.php/sql.php Login Action login_username Parameter SQL Injection

The remote host is running Cacti, a web-based front-end to RRDTool for network graphing. The version of Cacti installed on the remote host fails to sanitize user input to the 'loginusername' parameter before using it in the 'authlogin.php' script to perform database queries. Regardless of PHP's...

mixsys-sql.txt

? echo "\n"; echo "-------------------------Mix Systems CMS--------------------------"."\n"; echo "-----------------------coded by : halkfild------------------------"."\n"; echo "----------------------------antichat.ru------------------------"."\n"; if $argc!=4 echo " Usage: php ".$argv0." host...

Mix Systems CMS (parent/id) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================== Mix Systems CMS parent/id Remote SQL Injection Exploit ======================================================== ? echo "\n"; echo "-------------------------Mix Systems...

Mix Systems CMS - parentid SQL Injection

Mix Systems CMS - parentid SQL Injection ? echo "\n"; echo "-------------------------Mix Systems CMS--------------------------"."\n"; echo "-----------------------coded by : halkfild------------------------"."\n"; echo "----------------------------antichat.ru------------------------"."\n"; if...

Mix Systems CMS - 'parent/id' SQL Injection

? echo "\n"; echo "-------------------------Mix Systems CMS--------------------------"."\n"; echo "-----------------------coded by : halkfild------------------------"."\n"; echo "----------------------------antichat.ru------------------------"."\n"; if $argc!=4 echo " Usage: php ".$argv0." host...

AkoGallery Component for Mambo / Joomla! 'id' Parameter SQLi

The version of the AkoGallery component for Joomla! running on the remote host is affected by a SQL injection vulnerability in the akogallery.php script due to improper sanitization of user-supplied input to the 'id' parameter before using it to construct database queries in the GalleryHeader...

WordPress AdServe 'adclick.php' 'id' Parameter SQL Injection

The remote host is running AdServe, a third-party ad banner plugin for WordPress. The version of AdServe installed on the remote host fails to sanitize input to the 'id' parameter of the 'adclick.php' script before using it in a database query. Regardless of PHP's 'magicquotesgpc' setting, an...