CVE-2008-3362: Improper Input Validation

Unrestricted file upload vulnerability in upload.php in the Giulio Ganci Wp Downloads Manager module 0.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension via the upfile parameter, then accessing it via a direct request to the file in...

HIOX Browser Statistics 2.0 - Arbitrary Add Admin

"; fclose$file; $creat = "false"; echo "New User Created Please Wait You will be Redirected to Login Page "; else echo "Enter correct Username or Password "; if$creat == "true" ? table align=center valign=center bgcolor=000000 align=center cellpadding=0 style="border: 1p...

WordPress Wp Downloads Manager 'upload.php'任意文件上传漏洞

BUGTRAQ ID: 30365 CNCAN ID：CNCAN-2008072803 WordPress Wp Downloads Manager是一款WordPress的下载管理程序。 WordPress Wp Downloads Manager不正确过滤用户提交的WEB数据，远程攻击者可以利用漏洞上传任意文件。 问题存在于'upload.php'中，攻击者可上传恶意PHP文件，并以WEB权限执行。 Giulio Ganci Wp Downloads Manager 0.2 目前没有解决方案提供：...

Unfixed XSS vulnerability at www.bestvistadownloads.com

Security researcher Zeryus, has submitted on 07/06/2008 a cross-site-scripting XSS vulnerability affecting www.bestvistadownloads.com, which at the time of submission ranked 11661 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/06/2008. It i...

Directory traversal

Multiple directory traversal vulnerabilities in HomePH Design 2.10 RC2, when registerglobals is enabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the 1 thumbtemplate parameter to a admin/templates/templatethumbnail.php, and the 2...

Trac quickjump Search Script q Parameter Arbitrary Site Redirect

The remote host is running Trac, an enhanced wiki and issue tracking system for software development projects. The version of Trac installed on the remote host fails to sanitize user input to the 'q' parameter of the 'search' script before using it in an unfiltered and unmanaged fashion in a...

theratcms-sqlxss.txt

========================================================== The Rat CMS SQL/XSS Multiple Remote Vulnerabilities ========================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

Easy-Clanpage 3.0b1 (section) Local File Inclusion Vulnerability

No description provided by source. LFI Exploit by Loader007 you can connect me for questions ICQ:488525928 Script:Easy-Clanpage 3.0b1 download: http://www.easy-clanpage.de/?section=downloads&show=viewdownload&id=24 http://example.de/path/?section=LFI%00 HowTo use it 1: make a account 2: up shell ...

Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting

==================================================================== Gravity Board X 2.0 Beta SQL/XSS Multiple Remote Vulnerabilities ==================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking...

Akamai Download Manager < 2.2.3.7 - ActiveX Remote Download

Download Manager window.resizeTo500,510; var bDocReady = false; var bInsObj = false; var isLinux = navigator.userAgent.indexOf"Linux" = 0; var isMacFF = navigator.userAgent.indexOf"Firefox" = 0 && navigator.userAgent.indexOf"Mac" = 0; var isSafari = navigator.userAgent.indexOf"Safari" = 0; var...

c6msg-activex.txt

!-- C6 Messenger Installation Url DownloaderActiveX Control Remote Download & Execute Exploit by Nine:Situations:Group::SnoopyAssault site: http://retrogod.altervista.org/ "C6 Messenger is an instant messaging program produced by Telecom Italia Group, specifically by Alice distribution, Icon Spa...

meBiblio 0.4.7 (SQL/Upload/XSS) Multiple Remote Vulnerabilities

No description provided by source. ======================================================================================== meBiblio 0.4.7 Remote SQL Injection/ Arbitrary File Upload Exploit / XSS Vulnerability ======================================================================================...

CMSimple 3.1 - Local File Inclusion Arbitrary File Upload

CMSimple 3.1 - Local File Inclusion Arbitrary File Upload CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion :...

Koobi CMS 4.2.4/4.2.5/4.3.0 Multiple Remote SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications ========================================================================= Koobi CMS 4.2.4/4.2.5/4.3.0 Multiple Remote SQL Injection Vulnerabilities ========================================================================= + Info: Software:...

Dream4 Koobi CMS 4.2.4/4.2.5/4.3.0 - Multiple SQL Injections

--==+=================== Spanish Hackers Team www.spanish-hackers.com =================+==-- --==+ Koobi CMS 4.3.0, 4.2.5, 4.2.4 Multiple Remote SQL Injection +==-- --==+====================================================================================+==-- + JosS + Spanish Hackers Team + Sys -...

phpwebsitedownloads-sql.txt

powered by phpWebSitedownloads AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAiL : [email protected] DORK 1 : allinurl:"mod.php?mod=downloads" EXPLOIT :...

SOL8508 - Cross-site scripting vulnerability in installControl.php3 page

A cross-site scripting XSS vulnerability exists in the FirePass installControl.php3 page, which is accessible prior to authentication. The installControl.php3 page fails to fully sanitize URL input before the web page content is sent to the browser. It is possible for an attacker to create web...

Sql injection

SQL injection vulnerability in the downloads module in Koobi Pro 5.7 allows remote attackers to execute arbitrary SQL commands via the categ parameter to index.php. NOTE: it was later reported that this also affects Koobi CMS 4.2.4, 4.2.5, and 4.3.0...

CVE-2008-1122: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the downloads module in Koobi Pro 5.7 allows remote attackers to execute arbitrary SQL commands via the categ parameter to index.php. NOTE: it was later reported that this also affects Koobi CMS 4.2.4, 4.2.5, and 4.3.0...

PHP-Nuke Module Downloads SQL Injection&#40;sid&#41;

PHP-Nuke Module Downloads SQL Injectionsid AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAL : [email protected] DORK 1 : allinurl: sid "modules php name Downloads" DORK 2 : allinurl: sid"dop=viewsdownload" EXPLOIT : admin =...