Zen Cart 1.5.3 - Multiple Vulnerabilities

Zen Cart 1.5.3 - Multiple Vulnerabilities Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id...

Zen Cart 1.5.3 - Multiple Vulnerabilities

Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id. localhost/zen/zen-cart-v1.5.3-07042014/admin123/profiles.php?action=delete&profile=2 - Reset layou...

ExpressionEngine: Stored Cross-Site Scripting Vulnerability in /admin.php?/cp/admin_system/general_configuration

Vulnerability: Stored XSS Persistent Severity: High Vulnerable Parameter: siteindex PoC: POST /exe/admin.php?/cp/adminsystem/generalconfiguration&S=98be920eacf52890b4b159431a7da8cf HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:31.0 Gecko/20100101 Firefox/31.0...

Crescendo - Sales CRM Authentication Bypass Vulnerability

Exploit for asp platform in category web applications Crescendo - Sales CRM Authentication Bypass Vulnerability Exploit Title: Crescendo - Sales CRM Authentication Bypass Vulnerability Sql Injection Google Dork: N/A Date: July 15 , 2014 Exploit Author: Monendra Sahu email protected Vendor Homepag...

Sql injection

SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter...

CVE-2014-5090

admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel...

Code injection

admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel...

CVE-2014-5090

admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel...

CVE-2014-5090

CVE-2014-5090 affects Status2k Server Monitoring Software. admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field of Add Logs in the Admin Panel. CVSSv2 base score is 6.5 (MEDIUM) with vector AV:N/...

Dlink DWR-113 Rev. Ax - CSRF Denial of Service

It was observed that the D-link DWR-113 wireless router is vulnerable to denial of service attack via CSRFCross-Site Request Forgery vulnerability. An attacker could craft a malicious CSRF exploit to change the password in the password functionality when the useradmin is logged in to the...

D-Link DWR-113 Cross Site Request Forgery

Exploit Title: Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service Google dork : N/A Exploit Author: Blessen Thomas Date : 29/07/14 Vendor Homepage : http://www.dlink.com/ Software Link : N/A Firmware version: v2.02 2013-03-13 Tested on : Windows 7 CVE : CVE-2014-3136 Type of Application : Web...

OctavoCMS Admin Panel Cross Site Scripting

Title : OctavoCMS Admin Panel Cross Site Scripting Vendor : http://octavocms.com/ Date : 2014.07.10 ================================ Proof of concept : First You should Login As Admin ... 1 : http://TARGET/admin/media/add.php?action="alert/XSS/ 2 :...

Zen Cart 1.5.3 - CSRF & Admin Panel XSS

Exploit for php platform in category web applications Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id...

Quick.Cart 6.4 & Quick.Cms 5.4 - Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: Quick.Cart 6.4 & Quick.Cms 5.4 - Cross Site Scripting Date: 09.07.14 Vendor: opensolution.org Affected verions: Quick.Cart and Quick.Cms, latest versions Tested on: Apache 2.2.22 at Debian Contact: smash at devilteam.pl Vulnerabilities...

Mesut Manþet Haber 1.0 - Auth Bypass Vulnerability

No description provided by source. ============================================================================== » Note : LionTurk.Turkblog.com Resmi Web Sitem :D ============================================================================== »Mesut Manþet Haber V1.0 Auth Bypass Vulnerability...

MeltingIce File System <= 1.0 - Remote Arbitrary Add-User Exploit

No description provided by source. !/usr/bin/perl use strict; use LWP::UserAgent; NOTE: user a pretty uniqe username, has the script will say successfull if a username aready existed! NOTE: exploit is mainly to get a nice quota, but it can also to be used to add a user primeraly because alot of...

Build a Niche Store 3.0 - (BANS) Authentication Bypass Vulnerability

No description provided by source. + Exploit Title : Build a Niche Store v3.0 BANS Authentication Bypass Vulnerability Author : ThunDEr HeaD Contact : [email protected] Date : 13-11-2010 HomePage : www.indishell.in Price : $49.95 Version : 3.0 Software: http://www.buildanichestore.com/...

MyBlog <= 0.9.8 Insecure Cookie Handling Vulnerability

No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= MyBlog = 0.9.8: PHP and MySQL Blog/CMS software / Cookie poisioning -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= $ Program: MyBlog $ File affected: all /admin/.php files...

xeCMS <= 1.0.0 RC2 Insecure Cookie Handling Vulnerability

No description provided by source. -+================================================================================+- -+ xeCMS = 1.0.0 RC2 Insecure Cookie Handling Vulnerability +- -+================================================================================+- Discovered By: t0pP8uZz...

Webyapar 2.0 - Multiple Remote SQL Injection Vulnerabilities

No description provided by source. /$$$$$$$$$$$////$$$$$$$$$$$///////////////$$$$$$$$$$$$$$$//$$$$$$$$$$$$$$$/ ////////$$$$$$$$//////////$$$$$$$$/////////////////$$$$$//$$$$/////////////$$$$////////////...