eNdonesia 8.4 (Calendar Module) - SQL Injection

eNdonesia 8.4 Calendar Module - SQL Injection !/usr/bin/perl /-----------------------------------------------\ | /-----------------------------------------\ | | | Remote SQL Exploit | | | | eNdonesia 8.4 Remote SQL Exploit | | | | www.endonesia.org | | | | Calendar Module | | |...

Sql injection

Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the 1 artid parameter to mod.php in a viewarticle action publisher mod and the 2 bid parameter to banners.php in a click action. NOTE: the mod.php viewdisk and viewlink vectors are...

CVE-2007-3394

Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via the 1 artid parameter to mod.php in a viewarticle action publisher mod and the 2 bid parameter to banners.php in a click action. NOTE: the mod.php viewdisk and viewlink vectors are...

CVE-2007-3394

Summary (CVE-2007-3394): Multiple SQL injection vulnerabilities in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL via (1) the artid parameter to mod.php in a viewarticle action (publisher mod) and (2) the bid parameter to banners.php in a click action. The mod.php viewdisk and view...

endonesia84-sql.txt

Application: eNdonesia 8.4 Web Site: http://www.endonesia.org/ Versions: all Platform: linux, windows Bug: multiple injection sql Fix Available: no ------------------------------------------------------- 1 Introduction 2 Bug 3 proof of concept =========== 1 Introduction =========== "eNdonesia 8.4...

eNdonesia 8.4 - 'banners.php?click Action bid' SQL Injection

source: https://www.securityfocus.com/bid/24590/info eNdonesia is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the...

CVE-2006-6872

Directory traversal vulnerability in mod.php in eNdonesia 8.4 allows remote attackers to read arbitrary files via a .. dot dot in the mod parameter...

CVE-2006-6873

CVE-2006-6873 describes multiple SQL injection vulnerabilities in mod.php of eNdonesia 8.4. The affected component is the mod.php file, with vulnerable vectors via (1) the did parameter in a viewdisk operation and (2) the cid parameter in viewlink (katalog mod) or viewcat (diskusi mod). The under...

CVE-2006-6872

Technical details about CVE-2006-6872 are not publicly available in the provided connected documents; only the basic description and references are present. Monitor for updates.

CVE-2006-6871

Multiple cross-site scripting XSS vulnerabilities in eNdonesia 8.4 allow remote attackers to inject arbitrary web script or HTML via 1 the mod parameter in a viewlink operation in mod.php, 2 the intypeid parameter in a showinfo operation in the informasi module in mod.php, 3 the "your Friend" fie...

CVE-2006-6873

Multiple SQL injection vulnerabilities in mod.php in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via 1 the did parameter in a a viewdisk operation diskusi mod, or the 2 cid parameter in a b viewlink katalog mod or b viewcat diskusi mod operation...

CVE-2006-6871

CVE-2006-6871 affects eNdonesia 8.4 with four XSS vectors : (1) mod.php viewlink parameter (mod), (2) informasi module showinfo intypeid, (3) the "your Friend" field in friend.php, (4) the "Main Text" field in admin.php. The vulnerability allows remote attackers to inject arbitrary web script or ...

CVE-2006-6874

Multiple cross-site scripting XSS vulnerabilities in friend.php in eNdonesia 8.4 allow remote attackers to inject arbitrary web script or HTML via the 1 Message or 2 Your Name field. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6874

The vulnerability is an XSS flaw in eNdonesia 8.4, specifically in the file/functIon friend.php, exploitable via the (1) Message or (2) Your Name fields. The connected records confirm affected software and version (eNdonesia 8.4) and that remote attackers can inject arbitrary web script or HTML. ...

CVE-2006-6871

Multiple cross-site scripting XSS vulnerabilities in eNdonesia 8.4 allow remote attackers to inject arbitrary web script or HTML via 1 the mod parameter in a viewlink operation in mod.php, 2 the intypeid parameter in a showinfo operation in the informasi module in mod.php, 3 the "your Friend" fie...

CVE-2006-6872

Directory traversal vulnerability in mod.php in eNdonesia 8.4 allows remote attackers to read arbitrary files via a .. dot dot in the mod parameter...

CVE-2006-6873

Multiple SQL injection vulnerabilities in mod.php in eNdonesia 8.4 allow remote attackers to execute arbitrary SQL commands via 1 the did parameter in a a viewdisk operation diskusi mod, or the 2 cid parameter in a b viewlink katalog mod or b viewcat diskusi mod operation...

CVE-2006-6874

Multiple cross-site scripting XSS vulnerabilities in friend.php in eNdonesia 8.4 allow remote attackers to inject arbitrary web script or HTML via the 1 Message or 2 Your Name field. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

eNdonesia 8.4 (mod.php/friend.php/admin.php) Multiple Vulnerabilities

No description provided by source. bugs for Endonesia8.4 FInd:z1ckXru mail:[email protected] 1 http://localhost/en/mod.php?mod=XSS&op=viewlink&cid=5 2 http://localhost/en/friend.php your Friend:XSS 3 http://localhost/en/admin.php Main Text: XSS 4...

eNdonesia 8.4 - mod.phpfriend.phpadmin.php Multiple Vulnerabilities

eNdonesia 8.4 - mod.phpfriend.phpadmin.php Multiple Vulnerabilities bugs for Endonesia8.4 FInd:z1ckXru mail:[email protected] 1 http://localhost/en/mod.php?mod=XSS&op=viewlink&cid=5 2 http://localhost/en/friend.php your Friend:XSS 3 http://localhost/en/admin.php Main Text: XSS 4...