557 matches found
CVE-2009-1489: Improper Authentication
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter...
ECShop 2.5.0 (order_sn) Remote SQL Injection Vulnerability
ecshop2.5.0 user.php存在sql注入漏洞 user.php 2176行： else if $action == 'orderquery' $ordersn = empty$GET'ordersn' ? '' : trimsubstr$GET'ordersn', 1; includeonceROOTPATH .'includes/clsjson.php'; $json = new JSON; $result = array'error'=0, 'message'='', 'content'=''; ifisset$SESSION'lastorderquery' iftim...
CVE-2008-6394: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cscookiescustomeruserid cookie parameter...
CS-Cart 'core/user.php' SQL注入漏洞
BUGTRAQ ID: 30979 CNCAN ID：CNCAN-2008090301 CS-Cart是一款基于PHP的WEB应用程序。 CS-Cart不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'core/user.php'脚本对用户提交给WEB参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 CS-Cart 1.3.5 可联系供应商获得补丁信息： http://www.cs-cart.com/...
CS-Cart <= 1.3.5 SQL Injection
GulfTech Security Research September 02, 2008 Vendor : CS-Cart.com URL : http://www.cs-cart.com/ Version : CS-Cart = 1.3.5 Risk : SQL Injection Description: CS-Cart Cart is a full featured online ecommerce application written in php that allows users to build, run and promote an online store. The...
Multiple vulnerabilities in Envolution
Здравствуйте 3APA3A! Сообщаю вам о найденных мною многочисленных уязвимостях в системе Envolution, в частности Insuficient Anti-automation и Cross-Site Scripting. Insuficient Anti-automation: Уязвимость в user.php в модуле NS-NewUser...
Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection
Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection GulfTech Security Research July 30, 2008 Vendor : Pligg LLC URL : http://www.pligg.com/ Version : Pligg alertdocument.cookie; The above example link would display the end users cookie to them. Of course this can also be use...
Vulnerabilities in PostNuke Phoenix
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation и Cross-Site Scripting уязвимостях в PostNuke Phoenix. Insufficient Anti-automation: Уязвимость в user.php в модуле NS-NewUser...
Unfixed XSS vulnerability at www.iauq.ac.ir
Security researcher MK, has submitted on 13/07/2008 a cross-site-scripting XSS vulnerability affecting www.iauq.ac.ir, which at the time of submission ranked 886585 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2009. It is currently...
Sql injection
Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user'language' variable, probably related to SQL injection...
CVE-2008-3070
Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user'language' variable, probably related to SQL injection...
CVE-2008-3070: Improper Neutralization of Special Elements used in an SQL Command
Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user'language' variable, probably related to SQL injection...
Sql injection
Multiple SQL injection vulnerabilities in yBlog 0.2.2.2 allow remote attackers to execute arbitrary SQL commands via 1 the q parameter to search.php, or the n parameter to 2 user.php or 3 uss.php...
CVE-2008-2668
CVE-2008-2668 : The provided documents identify multiple cross-site scripting (XSS) vulnerabilities in the web application yBlog 0.2.2.2 . The vulnerabilities can be triggered by user-supplied input in the following parameters: (1) the q parameter to search.php, and (2) the n parameter to either ...
CVE-2008-2668
Multiple cross-site scripting XSS vulnerabilities in yBlog 0.2.2.2 allow remote attackers to inject arbitrary web script or HTML via 1 the q parameter to search.php, or the n parameter to 2 user.php or 3 uss.php...
CVE-2008-2669: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in yBlog 0.2.2.2 allow remote attackers to execute arbitrary SQL commands via 1 the q parameter to search.php, or the n parameter to 2 user.php or 3 uss.php...
yBlog 0.2.2.2 (XSS/SQL) Multiple Remote Vulnerabilities
No description provided by source. / | || | | | | | | | | /| | | | | || ||| ||||| || C. H. R. O. O. T. SECURITY GROUP - -- ----- --- -- -- ---- --- -- - http://www.chroot.org Hacks In Taiwan | || | | | | | | | Conference 2008 | | ...
Yblog 0.2.2.2 - Cross-Site Scripting SQL Injection
Yblog 0.2.2.2 - Cross-Site Scripting SQL Injection / | || | | | | | | | | /| | | | | || ||| ||||| || C. H. R. O. O. T. SECURITY GROUP - -- ----- --- -- -- ---- --- -- - http://www.chroot.org Hacks In Taiwan | || | | | | | | | Conference 2008 | | | | | | | | | || ||| || ||||...
Yblog 0.2.2.2 - Cross-Site Scripting / SQL Injection
/ | || | | | | | | | | /| | | | | || ||| ||||| || C. H. R. O. O. T. SECURITY GROUP - -- ----- --- -- -- ---- --- -- - http://www.chroot.org Hacks In Taiwan | || | | | | | | | Conference 2008 | | | | | | | | | || ||| || |||| http://www.hitcon.org Title =======:: yBlog 0.2.2.2 Multiple Remote...
Sql injection
SQL injection vulnerability in content/user.php in AuraCMS 2.2.1 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the country parameter...