CVE-2007-6584: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in 1024 CMS 1.3.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the lang parameter to pages/print/default/ops/news.php or 2 the themedir parameter to pages/download/default/ops/search.php; or the adminthemedi...

CVE-2007-6583: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/ops/findip/ajax/search.php in 1024 CMS 1.3.1 allows remote attackers to execute arbitrary SQL commands via the ip parameter...

CuteNews search.php files_arch Array Arbitrary File Access

The version of CuteNews on the remote host fails to initialize the 'filesarch' array before populating it with a list of files to search in the 'search.php' script. Regardless of PHP's 'registerglobals' setting, an unauthenticated attacker can leverage this issue to determine the existence of...

Woltlab Burning Board Lite Search.PHP多个SQL注入漏洞

BUGTRAQ ID: 26973 CNCAN ID:CNCAN-2007122403 Woltlab Burning Board Lite是一款基于PHP的WEB应用程序。 Woltlab Burning Board Lite不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或操作数据库。 问题是'Search.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 WoltLab Burning Board Lite 1.0.2 目前没有解决方案提供：...

Woltlab Burning Board Lite Search.PHP SQL注入漏洞

BUGTRAQ ID: 26973 CNCAN ID:CNCAN-2007122407 Woltlab Burning Board Lite是一款基于PHP的WEB应用程序。 Woltlab Burning Board Lite不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 WoltLab Burning Board Lite 1.0.2 目前没有解决方案提供：...

Woltlab Burning Board Lite "search.php" SQL Injection Vulnerabilities

Multiple vulnerabilities have been identified in Woltlab Burning Board Lite, which could be exploited by remote attackers to execute arbitrary SQL queries. These issues are caused by input validation errors in the "search.php" script when processing the "showposts", "sortby" and "sortorder"...

CVE-2007-6518: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in search.php in WoltLab Burning Board wBB Lite 1.0.2 pl3e allow remote attackers to execute arbitrary SQL commands via the 1 showposts, 2 sortby, and 3 sortorder parameters...

Woltlab Burning Board 1.0.2 SQL-Injection Vulnerability

In Woltlab Burning Board Lite1.0.2 is a SQL-Injection Vulnerability in file: search.php : Line: 510-515 if!$savepostids eval"error"".$tpl-get"errorsearchnoresult"."";"; $result=$db-queryfirst"SELECT searchid FROM bb".$n."searchs WHERE postids='$savepostids' AND showposts='$POSTshowposts' AND...

Sql injection

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

CVE-2007-6472

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

wbb-sql.txt

In Woltlab Burning Board Lite1.0.2 is a SQL-Injection Vulnerability in file: search.php : Line: 510-515 if!$savepostids eval"error"".$tpl-get"errorsearchnoresult"."";"; $result=$db-queryfirst"SELECT searchid FROM bb".$n."searchs WHERE postids='$savepostids' AND showposts='$POSTshowposts' AND...

phpmyrealty-sql.txt

xaker.name & grabberz.com . . NN NNNN JNNN NNNN. NNN NNNNNNNNNNN NN NN NNN.NNNF .NNNNN NN """4NNN""" NN NN NNNNNN NNNNN NNN NNN NN NN 4NNNN NNNNNN.NNF NNN NN NN JNNNNL NN NNNNNN NNN NN NN JNNNNNN JNN NNNNN JNNF NN NN .NNNF NNN. NNN 4NNN NNN NN NN JNNN NNNN NN NNN NNN NN NN NN . http://xaker.name...

CVE-2007-6472: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in phpMyRealty PMR 1.0.9 allow 1 remote attackers to execute arbitrary SQL commands via the type parameter to search.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the listingupdateddays parameter to admin/findlistings.ph...

phpMyRealty 1.0.x (search.php type) Remote SQL Injection Vulnerability

No description provided by source. xaker.name & grabberz.com . . NN NNNN JNNN NNNN. NNN NNNNNNNNNNN NN NN NNN.NNNF .NNNNN NN """4NNN""" NN NN NNNNNN NNNNN NNN NNN NN NN 4NNNN NNNNNN.NNF NNN NN NN JNNNNL NN NNNNNN NNN NN NN JNNNNNN JNN NNNNN JNNF&nbs...

PHPMyRealty 1.0.x - search.php SQL Injection

PHPMyRealty 1.0.x - search.php SQL Injection xaker.name & grabberz.com . . NN NNNN JNNN NNNN. NNN NNNNNNNNNNN NN NN NNN.NNNF .NNNNN NN """4NNN""" NN NN NNNNNN NNNNN NNN NNN NN NN 4NNNN NNNNNN.NNF NNN NN NN JNNNNL NN NNNNNN NNN NN NN JNNNNNN JNN NNNNN JNNF NN NN .NNNF NNN. NNN 4NNN NNN NN NN JNNN...

PHPMyRealty 1.0.x - 'search.php' SQL Injection

xaker.name & grabberz.com . . NN NNNN JNNN NNNN. NNN NNNNNNNNNNN NN NN NNN.NNNF .NNNNN NN """4NNN""" NN NN NNNNNN NNNNN NNN NNN NN NN 4NNNN NNNNNN.NNF NNN NN NN JNNNNL NN NNNNNN NNN NN NN JNNNNNN JNN NNNNN JNNF NN NN .NNNF NNN. NNN 4NNN NNN NN NN JNNN NNNN NN NNN NNN NN NN NN . http://xaker.name...

Unfixed XSS vulnerability at www.expressddl.com

Security researcher Uber0n, has submitted on 17/12/2007 a cross-site-scripting XSS vulnerability affecting www.expressddl.com, which at the time of submission ranked 83759 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 23/12/2007. It is...

CVE-2007-6202: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in plugins/search/search.php in Neocrome Seditio CMS 121 and earlier allows remote attackers to execute arbitrary SQL commands via the pagsub parameter to plug.php...

CVE-2003-1536

Multiple cross-site scripting XSS vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via 1 the q parameter to search.php and 2 the year parameter to calendar.php...

Unfixed XSS vulnerability at www.yogawiz.com

Security researcher CoNqUeRoR, has submitted on 11/08/2007 a cross-site-scripting XSS vulnerability affecting www.yogawiz.com, which at the time of submission ranked 404635 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/08/2007. It is...