Multiple SQL Injection Vulnerabilities in EcommerceMajor

ecommerceMajor is a PHP-based content management system CMS for building e-commerce portals developed by software developer Bhaskar. EcommerceMajor has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the productbycat parameter product.php o...

Skeleton Key Malware Bypasses Active Directory Authentication

Enterprise Active Directory administrators need to be on the lookout for anomalous privileged user activity after the discovery of malware capable of bypassing single-factor authentication on AD that was used as part of a larger cyberespionage campaign against a global company based in London...

poMMo Aardvark Cross-Site Request Forgery Vulnerability

poMMo Aardvark is a PHP-based mass mailing software. A cross-site request forgery vulnerability exists in poMMo Aardvark PR16.1, which allows remote attackers to hijack administrative authentication by hijacking request authentication of administrars modifying credentials via certain admin...

PHPAPP注入第真十二枚（无视过滤）

简要描述： PHPAPP注入第真十二枚（无视过滤） 详细说明： 在wooyun上看到了有人提了PHPAPP的漏洞： http://wooyun.org/bugs/wooyun-2010-055604，然后去官网看了看，前几天刚有更新，就在官网下了PHPAPP最新的v2.6来看看2014-12-11更新的。 PSOT注入点：wwww.xxx.com/index.php?action=8&app=80, 存在漏洞的文件在/phpapp/apps/taskcount/mainphpapp.php 下面分析一下漏洞产生的原因 第一处绕过：...

DayuCMS 1.525 /member/include/tag.class.php SQL注入漏洞

/member/include/member.class.phpfunction exists$field, $value return $this-db-fetchone"SELECT id FROM $this-table WHERE $this-table.$field='$value' LIMIT 0, 1"; 传入的$field和$value未经过过滤直接带入SQL语句中。 /member/include/msg.class.php function send$msgs global $userid,$username,$member;...

Qibo Menhu V5 /wei/js.php SQL注入漏洞

/wei/js.php elseif$type=='like' $SQL.=" AND id!='$id' "; if!$keyword extract$db-getone"SELECT keywords AS keyword FROM $precontent WHERE id='$id'"; if$keyword $SQL.=" AND "; $keyword=urldecode$keyword; $detail=explode" ",$keyword; unset$detail2; foreach $detail AS $key=$value $detail2=" BINARY...

CVE-2014-2363

Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request...

CVE-2014-2363 Morpho Itemiser 3 Hard-Coded Credential

Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request...

ZKSoftware WebServer Default Admin Credentials (HTTP)

The ZKSoftware WebServer is using default admin credentials. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

nas4free Default Admin Credentials (HTTP)

The remote nas4free web interface is using known default credentials. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Plogger <= Beta 2.1 Administrative Credentials Disclosure Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo Plogger = Beta 2.1 SQL injection / administrative credentials disclosure\r\n; echo by rgod [email protected]\r\n; echo site: http://retrogod.altervista.org\r\n\r\n; echo - works with magicquotesgpc = Off\r\n\r\n; echo...

phpMyChat 0.14.5 - Remote Improper File Permissions Exploit

No description provided by source. | | | | | | |/ \ \ /\ / / | | | | \ V V / || ||/ // Security Group. phpMyChat remote sploit by sysbug C:\Perl\binperl pmc.pl www.kublooddrive.com /chat / Mysql dump : CDBHOST : localhost CDBNAME : jhawkpchat1 CDBUSER : jhawkpchat1 CDBPASS : vvejTjeLgB Adding...

Technicolor TC7200 - Credentials Disclosure

No description provided by source. Exploit Title: Technicolor TC7200: Authentication Bypass Google Dork: N/A Date: 24-02-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.technicolor.com/ Software Link:...

phpCOIN 1.2.1 (mod.php) - SQL Injection Vulnerability

No description provided by source. phpCOIN 1.2.1 mod.php SQL Injection Vulnerability Author : Baybora Homepage : http://www.1923turk.com Blog : http://baybora.wordpress.com/ Script : phpCOIN 1.2.1 Download : http://www.phpcoin.com/ Vulnerable File mod.php?mod=faq&mode=show&faqid= SQL XpL...

LoudBlog <= 0.5 (id) SQL Injection / Admin Credentials Disclosure

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo LoudBlog = 0.5 'id' SQL injection / admin credentials disclosure\r\n; echo by rgod [email protected]\r\n; echo site: http://retrogod.altervista.org\r\n; echo a dork: \Powered by LoudBlog\r\n\r\n; / works regardless of...

LinPHA <= 1.3.1 (new_images.php) Remote Blind SQL Injection Exploit

No description provided by source. ?php / LinPHA = 1.3.1 newimages.php Remote Blind SQL Injection Hash Fishing Exploit / BENCHMARK method author...: EgiX mail.....: n0b0d1esathotmaildotcom link.....: http://linpha.sourceforge.net/ dork.....: LinPHA Version 1.3.x or The LinPHA developers vulnerabl...

4PSA CMS SQL Injection Vulnerabilities

No description provided by source. Exploit Title: 4PSA CMS SQL Injection Vulnerabilities Google Dork: Communications solution from 4PSA. Date: 2012/02/19 Category : Web Application Author: BHG Security Center Discovered by : Nitrojen90 WebSite:WwW.Black-hg.Org Software Link: http://www.4psa.com/...

mobilelib gold 3.0 - (auth bypass/sql) Multiple Vulnerabilities

No description provided by source. ------------------Mobilelib Gold v3 Auth Bypass/SQL Multiple Remote Vulnerabilities---------------------------- ---------------------------------------------------------------------------------------------------------------- Script : Mobilelib Gold version : 3.0...

Nuked-klaN <= 1.7.7 / <= SP4.4 - Multiple Vulnerabilities Exploit

No description provided by source. ?php Name: Nuked-klaN = 1.7.7 and = SP4.4 Multiple Vulnerabilities Exploit Credits: Charles FOL charlesfolathotmail.fr URL: http://real.o-n.fr/ Date: 14/10/2008 Special thanks to Louis for remembering me I had to finish it = VULNERABILITY DETAILS...

JV2 Folder Gallery 3.0 0 - (download.php) Remote File Disclosure Exploit

No description provided by source. / Script Name :JV2 Folder Gallery Script site :www.jv2.net Discovered by :SaO Exploit Coded by :PeTrO Credits To soulreaver,Kuz3y Compile: Visual C++ or DevC++ / include stdio.h include string.h include winsock.h pragma commentlib,ws232.lib int mainint argc, cha...