communityXSS.txt

there is aproplem in Community forum community forum make by asp i found a xss in search when we typed http://www.victim.com/forum/search/SearchResults.aspx?q=alert'CSS%20Vulnerable'alert'CSS%20Vulnerable'b%20a=a%20&f=&u= it will make a xss credit [email protected] all ARAB EGYPT...

M4DR007-07SA.txt

M4DR007-07SA security advisory: Multiple vulnerabilities in ASP Nuke 0.80 Published: 26 16 2005 Released: 26 16 2005 Name: ASP Nuke Affected Systems: req " SIZE="22" MAXLENGTH="80" class="form" ... ? As we can see there isn't any control on the 'email' parameter when the board get it's value. Sin...

CVE-2002-1919

CVE-2002-1919 affects VP-ASP 4.0, exposing VP-ASP's shopadmin.asp to SQL injection via the username or password fields that can allow remote SQL execution and bypass authentication. Documents indicate a remote impact and administrator-level access possibility, but do not provide a confirmed patch...

CVE-2005-2065

Affected product: ASP Nuke 0.80 (language_select.asp). Vulnerability: HTTP response splitting via CRLF ("%0d%0a") in the LangCode parameter. Impact (as stated): remote attackers can spoof web content and poison web caches. Root cause: unsafely untrusted LangCode parameter allowing CRLF sequences....

CVE-2005-2064

Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the 1 email parameter to forgotpassword.asp, or the 2 FirstName, 3 LastName, 4 Username, 5 Password, 6 Address1, 7 Address2, 8 City, 9 ZipCode, 10 Email parameter to...

CVE-2005-2066

SQL injection vulnerability in commentpost.asp in ASP Nuke 0.80 allows remote attackers to execute arbitrary SQL statements via the TaskID parameter...

CVE-2002-1919

SQL injection vulnerability in shopadmin.asp in VP-ASP 4.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 password fields...

CVE-2005-2064

ASP Nuke 0.80 is affected by multiple cross-site scripting (XSS) vulnerabilities. The issue allows remote attackers to inject arbitrary script via the email parameter to forgot_password.asp or via the FirstName, LastName, Username, Password, Address1, Address2, City, ZipCode, and Email parameters...

CVE-2005-2065

HTTP response splitting vulnerability in languageselect.asp in ASP Nuke 0.80 allows remote attackers to spoof web content and poison web caches via CRLF "%0d%0a" sequences in the LangCode parameter...

CVE-2005-2066

CVE-2005-2066 : A SQL injection vulnerability exists in the ASP Nuke 0.80 web application via the TaskID parameter in the file comment_post.asp. Remote attackers could execute arbitrary SQL statements, as reported by the NVD entry, with an impact described as partial confidentiality, integrity, a...

CVE-2005-2066: Undefined Security Weakness

SQL injection vulnerability in commentpost.asp in ASP Nuke 0.80 allows remote attackers to execute arbitrary SQL statements via the TaskID parameter...

DUportal Pro Multiple Scripts SQL Injection (2)

The remote host is running DUportal Pro, an ASP-based product suite from DUware for building web portals / online communities. The installed version of DUportal Pro fails to properly sanitize user- supplied input in several instances before using it in SQL queries. By exploiting these flaws, an...

CVE-2002-1919: Undefined Security Weakness

SQL injection vulnerability in shopadmin.asp in VP-ASP 4.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the 1 username or 2 password fields...

aspnuke is vulnerable to sql injection

description aspnuke is web portal system written in asp . site : www.aspnuke.com POC It's possible to inject htttp://host/module/article/article/article.asp?articleid=1' for example you can change the admin username and password with this querry :...

M4DR007-07SA (security advisory): Multiple vulnerabilities in ASP Nuke 0.80

M4DR007-07SA security advisory: Multiple vulnerabilities in ASP Nuke 0.80 Published: 26 16 2005 Released: 26 16 2005 Name: ASP Nuke Affected Systems: = 0.80 Issue: Cross-Site Scripting, HTTP Response Splitting, SQL Injection Author: Alberto Trivero Vendor: http://www.aspnuke.com/ Software...

CVE-2005-2064: Undefined Security Weakness

Multiple cross-site scripting vulnerabilities in ASP Nuke 0.80 allow remote attackers to inject arbitrary web script or HTML via the 1 email parameter to forgotpassword.asp, or the 2 FirstName, 3 LastName, 4 Username, 5 Password, 6 Address1, 7 Address2, 8 City, 9 ZipCode, 10 Email parameter to...

XSS IN Community forum

there is aproplem in Community forum community forum make by asp i found a xss in search when we typed http://www.victim.com/forum/search/SearchResults.aspx?q=scriptalert'CSS20Vulnerable'/scriptb20a=a20&f=&u= EXAMPLE...

CVE-2005-2065: Undefined Security Weakness

HTTP response splitting vulnerability in languageselect.asp in ASP Nuke 0.80 allows remote attackers to spoof web content and poison web caches via CRLF "%0d%0a" sequences in the LangCode parameter...

DUamazon Pro Multiple Scripts SQL Injection

The remote host is running DUamazon Pro, an ASP-based storefront from DUware for Amazon affiliates. The installed version of DUamazon Pro fails to properly sanitize user- supplied input in several instances before using it in SQL queries. By exploiting these flaws, an attacker can affect database...

DUpaypal Pro Multiple Scripts SQL Injection

The remote host is running DUpaypal Pro, an ASP-based storefront from DUware for Paypal. The installed version of DUpaypal Pro fails to properly sanitize user- supplied input in several instances before using it in SQL queries. By exploiting these flaws, an attacker can affect database queries,...