Unfixed XSS vulnerability at www.lunametrics.com

Security researcher Kaospunk, has submitted on 24/01/2008 a cross-site-scripting XSS vulnerability affecting www.lunametrics.com, which at the time of submission ranked 192867 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 05/03/2008. It is...

CVE-2008-0382

Multiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to 1 forumdisplay.php or 2 a results action in search.php...

[waraxe-2008-SA#061] - Remote Code Execution in MyBB 1.2.10

waraxe-2008-SA061 - Remote Code Execution in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Independent discovery: koziolek Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-61.html Target...

MyBB forumdisplay.php 'sortby' Parameter Arbitrary PHP Code Execution

The version of MyBB installed on the remote host is affected by an arbitrary PHP code execution vulnerability due to improper sanitization of user-supplied input to the 'sortby' parameter of the forumdisplay.php script before using it in an eval statement to evaluate PHP code. A remote,...

MyBulletinBoard (MyBB) <= 1.2.10 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================================ MyBulletinBoard MyBB = 1.2.10 Multiple Remote Vulnerabilities ================================================================ waraxe-2008-SA061 - Remote Code Execution in My...

MyBulletinBoard (MyBB) 1.2.10 - Multiple Vulnerabilities

waraxe-2008-SA061 - Remote Code Execution in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Independent discovery: koziolek Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-61.html Target...

Sql injection

Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 status, 2 sort, and 3 way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the 4 msg and 5 password...

CVE-2008-0267

Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 status, 2 sort, and 3 way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the 4 msg and 5 password...

CVE-2008-0267

CVE-2008-0267 describes multiple SQL injection vulnerabilities in eTicket 1.5.5.2. The flaws allow remote authenticated users to inject arbitrary SQL via search.php parameters (status, sort, way) and remote authenticated administrators to inject via admin.php parameters (msg, password). The root ...

CVE-2007-6670

SQL injection vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to execute arbitrary SQL commands via the string parameter...

Sql injection

Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searchtext parameter to search.php, and unspecified other vectors...

CVE-2007-6669

Cross-site scripting XSS vulnerability in search.php in PHCDownload 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the string parameter...

eTicket 1.5.5.2 - search.php Multiple SQL Injections

eTicket 1.5.5.2 - search.php Multiple SQL Injections source: https://www.securityfocus.com/bid/27173/info eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection...

eTicket 1.5.5.2 - 'search.php' Multiple SQL Injections

source: https://www.securityfocus.com/bid/27173/info eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site scripting issue, and an...

MyPHP Forum 3.0 - 'Final' SQL Injection

================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / ================================================================================================= This is a Public Exploit. Date: 03/01/2008 dd,mm,yyyy...

MyPHP Forum 3.0 - search.php Multiple SQL Injections

MyPHP Forum 3.0 - search.php Multiple SQL Injections source: https://www.securityfocus.com/bid/27118/info MyPHP Forum is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allo...

myphp30-sql.txt

================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / ================================================================================================= This is a Public Exploit. Date: 03/01/2008 dd,mm,yyyy...

phcdownload-xss.txt

XSS Flaw & posible SQL injection in PHCDownload vendor url: http://www.phpcredo.com/ Advisore: http://lostmon.blogspot.com/2007/12/ xss-flaw-posible-sql-injection-in.html vendor notify:YES exploit available: YES New XSS Flaw & posible SQL injection in search.php PHCDownload contains a flaw that...

Unfixed XSS vulnerability at www.kwongwah.com.my

Security researcher DerickTham, has submitted on 29/12/2007 a cross-site-scripting XSS vulnerability affecting www.kwongwah.com.my, which at the time of submission ranked 32387 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/01/2008. It is...

CVE-2007-6583

CVE-2007-6583 is a SQL injection vulnerability in the 1024 CMS 1.3.1, specifically in the file path admin/ops/findip/ajax/search.php. The underlying issue allows remote attackers to inject SQL via the ip parameter and may enable partial confidentiality and integrity impact and partial availabilit...