CVE-2008-0278

SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a smwindow action...

Sql injection

SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a smwindow action...

CVE-2008-0278

CVE-2008-0278: X7 Chat (2.0.5 and possibly earlier) is vulnerable to SQL injection via the day parameter in index.php when page is set to event (sm_window action). The vulnerability allows remote attackers to manipulate database queries, potentially disclosing data, bypassing authentication, or m...

CVE-2008-0278

SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a smwindow action...

X7 Chat index.php day Parameter SQL Injection

The remote host is running X7 Chat, a web-based chat program written in PHP. The version of X7 Chat installed on the remote host fails to sanitize input to the 'day' parameter of the 'index.php' script when 'page' is set to 'event' before using it in 'sources/infobox.php' to construct database...

CVE-2008-0278: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a smwindow action...

X7 Chat 2.0.5 - 'day' SQL Injection

!/usr/bin/python Exploit for xchat 2.0.5 Saca los usuarios y los hash By nonroot - 2008 it's a PoC, please use responsibly import string,urllib import sys,re print "Target host: i.e: http://127.0.0.1/x7chat/" host=rawinput"Target host include http and /: " print "Output file: i.e: salida.txt"...

X7 Chat <= 2.0.5 (day) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications =================================================== X7 Chat \w+".findall foundusers=findallusersresponse if lenfoundusers==0: print "Sorry, exploit failed, please review the SQL string and try to change something like tables or wathever"...

docebo-exec.txt

getListTable." WHERE browsercode LIKE '%".$browserlanguage."%'"; executeQuery$qtxt; 801. 802. if $q && mysqlnumrows$q 0 803. $row=mysqlfetcharray$q; 804. $res=$row"regionid"; 805. an attacker cuold be inject SQL code through http accept-language header in the query at line 799, but explode functi...

CVE-2007-6315

BarracudaDrive Web Server vulnerability CVE-2007-6315: before version 3.8, remote authenticated users can cause a crash (denial of service) by sending an HTTP request to /eh/chat.ehintf/C that lacks a Connection ID, leading to a NULL pointer dereference. Impact is a partial availability loss per ...

CVE-2007-6315: Improper Restriction of Operations within the Bounds of a Memory Buffer

Group Chat in BarracudaDrive Web Server before 3.8 allows remote authenticated users to cause a denial of service crash via a HTTP request to /eh/chat.ehintf/C. that does not contain a Connection ID, which results in a NULL pointer dereference...

CVE-2007-6297: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PHPMyChat 0.14.5 allow remote attackers to inject arbitrary web script or HTML via the 1 LIMIT parameter to chat/deluser.php3, the 2 Link parameter to chat/edituser.php3, or the 3 LastCheck or 4 B parameter to chat/userspopupL.php3. NOTE: the...

barracudadrive 3.7.2 - Multiple Vulnerabilities

barracudadrive 3.7.2 - Multiple Vulnerabilities Luigi Auriemma Application: BarracudaDrive Web Server http://barracudaserver.com/products/BarracudaDrive/ http://barracudaserver.com/products/HomeServer/ Versions: = 3.7.2 Platforms: Windows Bugs: A directory traversal B scripts source visualization...

CVE-2007-6213

CVE-2007-6213 concerns WebED 0.0.9. Multiple directory traversal flaws in mod/chat/index.php allow remote reading of arbitrary files via a .. in the Root and Path parameters, affecting confidentiality (C:P) with no integrity/availability impact stated. CVSS v2 score is 5.0 (Medium) with network a...

CVE-2007-6213: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in mod/chat/index.php in WebED 0.0.9 allow remote attackers to read arbitrary files via a .. dot dot in the 1 Root and 2 Path parameters...

WebED 0.0.9 (index.php) Remote File Disclosure Vulnerability

Exploit for unknown platform in category web applications ============================================================ WebED 0.0.9 index.php Remote File Disclosure Vulnerability ============================================================ WebED v0.0.9 index.php Remote File Disclosure...

WebED 0.0.9 - 'index.php' Remote File Disclosure

WebED v0.0.9 index.php Remote File Disclosure Vulnerabilities Script : http://heanet.dl.sourceforge.net/sourceforge/ed-engine/WebEDv0.0.9.tar.gz Vuln Code In /mod/chat/index.php : PoC : /mod/chat/index.php?Root=../../../../../../etc/passwd /mod/chat/index.php?Path=../../../../../../etc/pa...

CVE-2007-6085

Multiple cross-site scripting XSS vulnerabilities in index.php in VigileCMS 1.4 allow remote attackers to inject arbitrary web script or HTML via the message field in the 1 vedipm or 2 livechat module...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in X7 Chat 2.0.4, 2.0.5, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the 1 room parameter to sources/frame.php, the 2 themec parameter to help/index.php, or the 3 INSTALLX7CHATVERSION parameter to...

CVE-2007-5982

Multiple cross-site scripting XSS vulnerabilities in X7 Chat 2.0.4, 2.0.5, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the 1 room parameter to sources/frame.php, the 2 themec parameter to help/index.php, or the 3 INSTALLX7CHATVERSION parameter to...