PunBB search.php old_searches Parameter SQL Injection

The version of PunBB installed on the remote host fails to sanitize user-supplied input to the 'oldsearches' parameter of the 'search.php' script before using it in database queries. Provided PHP's 'registerglobals' setting is enabled, an attacker may be able to exploit this issue to delete...

[KAPDA::#6] Punbb SQL Injection Vulnerability

KAPDA::6 Punbb SQL Injection Vulnerability Punbb search.php SQL Injection Vulnerability KAPDA New advisory Vulnerable products : Punbb V 1.2.8 and 1.2.7 are tested,Hopefully all other versions Vendor: http://www.punbb.org/ Vulnerability: Sql injection About Punbb -------------------- PunBB is a...

MyBloggie 2.1.3 - Search.PHP SQL Injection Vulnerability

MyBloggie 2.1.3 Search.PHP SQL Injection Vulnerability. Webapps exploit for php platform source: http://www.securityfocus.com/bid/15017/info myBloggie is prone to an SQL injection vulnerability. This is due to a lack of sanitization of user-supplied input before passing it on to SQL queries...

CVE-2005-3045

CVE-2005-3045 affects My Little Forum 1.5 and 1.6 beta, where the vulnerability resides in the search.php component. The underlying issue is a SQL injection via the phrase field, allowing remote attackers to alter the database by injecting arbitrary SQL commands. Documents consistently describe t...

CVE-2005-2839

Multiple cross-site scripting XSS vulnerabilities in MAXdev MD-Pro 1.0.72 allow remote attackers to inject arbitrary web script or HTML via 1 dl-search.php or 2 wl-search.php...

CVE-2005-2697

SQL injection vulnerability in search.php for MyBulletinBoard MyBB 1.00 Release Candidate 1 through 4 allows remote attackers to execute arbitrary SQL commands via the uid parameter. NOTE: this issue might overlap CVE-2005-0282...

mybbSQLinject.txt

Hello The Injected File : search.php Discovered by: HACKERS PAL & Devil-00 & ABDUCTER Injected Versions :- Powered by MyBulletinBoard 1.00 Release Candidate 4 Powered by MyBulletinBoard 1.00 Release Candidate 3 Powered by MyBulletinBoard 1.00 Release Candidate 2 Powered by MyBulletinBoard 1.00...

CVE-2005-2649

Cross-site scripting XSS vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via 1 course parameter in login.php or 2 words parameter in search.php...

MyBulletinBoard (MyBB) <= 1.00 RC4 SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================== MyBulletinBoard MyBB mhp0rtal -- Dr-CephaleX -- The-Cephexin -- DjayAgoustinno...

CVE-2005-2649

CVE-2005-2649 describes a cross-site scripting (XSS) vulnerability in ATutor 1.5.1 that allows remote attackers to inject arbitrary script or HTML via the parameters course in login.php or words in search.php. The CVE is cited with a base score of 4.3 (Medium) on the NVD entry, and multiple conne...

CVE-2005-2649

Cross-site scripting XSS vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via 1 course parameter in login.php or 2 words parameter in search.php...

Vul in MyBB

Hello The Injected File : search.php Discovered by: HACKERS PAL & Devil-00 & ABDUCTER Injected Versions :- Powered by MyBulletinBoard 1.00 Release Candidate 4 Powered by MyBulletinBoard 1.00 Release Candidate 3 Powered by MyBulletinBoard 1.00 Release Candidate 2 Powered by MyBulletinBoard 1.00...

CVE-2004-2350

SQL injection vulnerability in search.php for phpBB 1.0 through 2.0.6 allows remote attackers to execute arbitrary SQL and gain privileges via the searchresults parameter...

CVE-2005-2580

Multiple SQL injection vulnerabilities in MyBulletinBoard MyBB 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the Username field in 1 index.php or 2 member.php, action parameter to 3 search.php or 4 member.php, or 5 polloptions parameter to polls.php...

CVE-2005-2580

Multiple SQL injection vulnerabilities in MyBulletinBoard MyBB 1.00 RC4 with Security Patch allow remote attackers to execute arbitrary SQL commands via the Username field in 1 index.php or 2 member.php, action parameter to 3 search.php or 4 member.php, or 5 polloptions parameter to polls.php...

CVE-2004-2350

The CVE-2004-2350 entry pertains to an SQL injection in phpBB’s search.php affecting phpBB 1.0 through 2.0.6 via the search_results parameter. The underlying vulnerability allows remote attackers to execute arbitrary SQL and potentially gain privileges, as described in the fixed-text CVE descript...

CVE-2005-2580

CVE-2005-2580 affects MyBulletinBoard (MyBB) 1.00 RC4 with Security Patch. The vulnerability stems from improper sanitization of user input, enabling SQL injection via the Username field in index.php or member.php, via the action parameter in search.php or member.php, or via the polloptions param...

CVE-2005-2393

Cross-site scripting XSS vulnerability in CuteNews 1.3.6 allows remote attackers to inject arbitrary web script or HTML via 1 the lastusername parameter to index.php or 2 selectedsearcharch parameter to search.php...

CVE-2005-2402

The CVE-2005-2402 entry describes a Cross-site scripting (XSS) vulnerability in PHPSiteSearch 1.7.7d, specifically in search.php, where an attacker can inject arbitrary web script or HTML through the query parameter. The underlying issue is unescaped input in the search parameter that is echoed b...

CVE-2004-2242

Phorum contains a cross-site scripting vulnerability in search.php, exploitable via the subject parameter, potentially affecting Phorum 5.0.7 beta and earlier. The issue allows remote attackers to inject arbitrary HTML/JS. The public records describe the vulnerability but do not provide a concret...