xFlow 5.46.11 - 'index.cgi' Multiple SQL Injections

source: https://www.securityfocus.com/bid/17614/info xFlow is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successfully...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 action, 2 id, 3 num, 4 board, 5 cat, 6 real, 7 viewcat, 8 img, or 9 curcatname parameter in cgi-bin/index.cgi, or 10 vsSD parameter in...

CVE-2006-1427

CVE-2006-1427 involves multiple cross-site scripting (XSS) vulnerabilities in WebAPP 0.9.9.3.2 and earlier. The affected component is the web application’s CGI interfaces, specifically cgi-bin/index.cgi (parameters: action, id, num, board, cat, real, viewcat, img, curcatname) and /mods/calendar/i...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Jay Eckles CGI Calendar 2.7 allow remote attackers to inject arbitrary web script or HTML via the year parameter in 1 index.cgi and 2 viewday.cgi...

CVE-2006-0980

Multiple cross-site scripting XSS vulnerabilities in Jay Eckles CGI Calendar 2.7 allow remote attackers to inject arbitrary web script or HTML via the year parameter in 1 index.cgi and 2 viewday.cgi...

Boozt index.cgi overflow

It seems that index.cgi from Boozt AdBanner is installed and is vulnerable to a buffer overflow: it doesn't check the length of user supplied variables before copying them to internal arrays. A cracker may exploit this vulnerability to make your web server crash continually or even execute...

Boozt index.cgi overflow

It seems that index.cgi from Boozt AdBanner is installed and is vulnerable to a buffer overflow: It doesn SPDX-FileCopyrightText: 2002 Michel Arboi Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

ecart11.txt

------=Part73424926651.1114105332381 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=...

CVE-2005-1289

CVE-2005-1289 affects E-Cart 2004 1.1 and earlier. The issue is in index.cgi where user-supplied parameters (art and possibly cat) allow shell metacharacters to be interpreted, enabling remote execution of arbitrary commands. This is a remote code execution vulnerability with network access and n...

CVE-2005-1289

index.cgi in E-Cart 2004 1.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 art and possibly 2 cat parameters...

index.cgi script XSS + file show

Tunis 24/04/2005 BUG found by fireboy [email protected] THERE ARE SOME BUGS IN index.cgi SCRIPT THAT CAN SHOW SENSILBLES FILES IN A SYSTEM IT IS ONLY FOR SECURITY AND EDUCATIONAL PURPOSE 1file showing http://www.target.com/index.cgi?/etc/passwd 2CSS...

E-Cart <= 1.1 (index.cgi) Remote Command Execution Exploit

Exploit for cgi platform in category web applications ========================================================== E-Cart ; print "port: default: 80\n"; chomp$port=; $port=80 if $port =/\D/ ; $port=80 if $port eq "" ; print "path: /cgi-bin/ecart/\n"; chomp$path=; print "your ip for reverse connect:...

E-Cart 1.1 - index.cgi Remote Command Execution

E-Cart 1.1 - index.cgi Remote Command Execution !/usr/bin/perl Example added if code doesn't work for ya: http://SITE/DIRTOECART/index.cgi?action=viewart&cat=reproductoresdvd&art=reproductordvp-ns315.dat|uname%20-a| /str0ke info: [email protected] use IO::Socket; print "\n\n www.badroot.org...

commerceSQL.txt

CommerceSQL shopping cart http://commercesql.com allows remote file reading. It only needs to specially prepared page variable in index.cgi to allow reading remote files like /etc/passwd By using prepared GET page variable it allows user to read remote files Example: With...

[CommerceSQL] Remote File Read Vulnerability

CommerceSQL shopping cart http://commercesql.com allows remote file reading. It only needs to specially prepared page variable in index.cgi to allow reading remote files like /etc/passwd By using prepared GET page variable it allows user to read remote files Example: With...

CVE-2003-0416

CVE-2003-0416 affects Bandmin 1.4: the index.cgi component is vulnerable to cross-site scripting via (1) year or (2) month in showmonth, or (3) host in showhost. Root cause is improper handling of user-supplied input leading to arbitrary HTML/script insertion. Impact: potential theft of cookies o...

Boozt Standard 0.9.8 - index.cgi Buffer Overrun

Boozt Standard 0.9.8 - index.cgi Buffer Overrun // source: https://www.securityfocus.com/bid/6281/info A vulnerability has been discovered in Boozt. By passing a malicious parameter of excessive length to the index.cgi script, it is possible to overrun a buffer. This could be exploited by a remot...

Boozt Standard 0.9.8 - 'index.cgi' Buffer Overrun

// source: https://www.securityfocus.com/bid/6281/info A vulnerability has been discovered in Boozt. By passing a malicious parameter of excessive length to the index.cgi script, it is possible to overrun a buffer. This could be exploited by a remote attacker to corrupt sensitive memory, which ma...

CVE-2002-1007

Cross-site scripting vulnerabilities in Blackboard 5 allow remote attackers to execute arbitrary web script via 1 the courseid parameter in a link to login.pl, 2 the CTID parameter in ProcessInfo.cgi, or 3 the Message parameter in index.cgi...

CVE-2002-0098

CVE-2002-0098 describes a buffer overflow in Boozt AdBanner’s index.cgi admin interface of Boozt! Standard 0.9.8. The vulnerability occurs when a long banner creation name is copied into internal arrays, allowing local arbitrary code execution or a crash. Connected sources cite a CVSS v2 base sco...