CVE-2007-5828

Cross-site request forgery (CSRF) vulnerability in Django 0.96 is exposed in the admin panel, allowing remote attackers to change passwords via a request to admin/auth/user/1/password/. The issue stems from the default configuration not enabling the CSRF protection module, though Debian notes thi...

PT-2007-6792 · Django · Django

Name of the Vulnerable Software and Affected Versions: Django version 0.96 Description: A cross-site request forgery CSRF issue exists in the admin panel, allowing remote attackers to change passwords of arbitrary users via a request to "admin/auth/user/1/password/". This issue is disputed by...

CVE-2007-5828: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the admin panel in Django 0.96 allows remote attackers to change passwords of arbitrary users via a request to admin/auth/user/1/password/. NOTE: this issue has been disputed by Debian, since product documentation includes a recommendation for a CS...

Django 0.96 (stable) Admin Panel CSRF

Author: J. Carlos Nieto. Date: Oct 21, 2007 There exists a security hole in the default django's admin panel. Background ========== Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Django has an automatic admin panel that allows a person...

django-csrf.txt

Author: J. Carlos Nieto. Date: Oct 21, 2007 There exists a security hole in the default django's admin panel. Background ========== Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Django has an automatic admin panel that allows a person...

Input validation

Incomplete blacklist vulnerability in the Certificate Authority CA in IBM Lotus Domino before 7.0.3 allows local users, or attackers with physical access, to obtain sensitive information passwords when an administrator enters a "ca activate" or "ca unlock" command with any uppercase character,...

codewidget-sql.txt

http://Aria-Security.Net ------------------------------------- CodeWidgets.Com Online Event Registration Poc Normal User account: login.asp Email address: ' UNION SELECT FROM users password: Aria-Security.Net Admin Panel: adminlogin.asp Email address: ' UNION SELECT FROM admin Password:...

softbizjr-sql.txt

Softbiz Jobs & Recruitment Script SQL INJECTION BY IRCRASH AUTHOR : IRCRASH Dr.Crash Script Download : http://www.softbizscripts.com/ DORK: "Powered by SoftbizScripts" "ALL JOBS" Injection Adress : http://site.com/browsecats.php?cid=sql cod Sql code For see user name :...

Softbiz Jobs Recruitment - SQL Injection

Softbiz Jobs Recruitment - SQL Injection Softbiz Jobs & Recruitment Script SQL INJECTION BY IRCRASH AUTHOR : IRCRASH Dr.Crash Script Download : http://www.softbizscripts.com/ DORK: "Powered by SoftbizScripts" "ALL JOBS" Injection Adress : http://site.com/browsecats.php?cid=sql cod Sql code For se...

Softbiz Jobs & Recruitment Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================= Softbiz Jobs & Recruitment Remote SQL Injection Vulnerability ============================================================= Softbiz Jobs & Recruitment Script SQL INJECTION BY...

Softbiz Jobs & Recruitment - SQL Injection

Softbiz Jobs & Recruitment Script SQL INJECTION BY IRCRASH AUTHOR : IRCRASH Dr.Crash Script Download : http://www.softbizscripts.com/ DORK: "Powered by SoftbizScripts" "ALL JOBS" Injection Adress : http://site.com/browsecats.php?cid=sql cod Sql code For see user name :...

zomplog381-upload.txt

?php Zomplog = 3.8.1 Arbitrary File Upload Exploit by InATeam http://inattack.ru/ tested on versions 3.8.1 with security patch, 3.8.1, 3.8, 3.7.5 echo "------------------------------------------------------------\n"; echo "Zomplog = 3.8.1 Arbitrary File Upload Exploit\n"; echo "coded by Raz0r,...

greensql-xss.txt

Site: http://greensql.net/ live-demo: http://demo.greensql.net/ Platform: alls Bug: permanent xss Special condition: none Impact : semi-critical ------------------------------------------------------- 1 Introduction 2 Bug 3 Proof of concept 4 Credits =========== 1 Introduction =========== GreenSQ...

CVE-2007-5059

Multiple cross-site scripting XSS vulnerabilities in GreenSQL allow remote attackers to inject arbitrary web script or HTML via several vectors, as demonstrated by the 1 uname and 2 pass parameters in a login form, and 3 an unspecified "url value," leading to storage of XSS sequences in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in GreenSQL allow remote attackers to inject arbitrary web script or HTML via several vectors, as demonstrated by the 1 uname and 2 pass parameters in a login form, and 3 an unspecified "url value," leading to storage of XSS sequences in the...

CVE-2007-5059

Multiple cross-site scripting XSS vulnerabilities in GreenSQL allow remote attackers to inject arbitrary web script or HTML via several vectors, as demonstrated by the 1 uname and 2 pass parameters in a login form, and 3 an unspecified "url value," leading to storage of XSS sequences in the...

greensql firewall permanent xss

Site: http://greensql.net/ live-demo: http://demo.greensql.net/ Platform: alls Bug: permanent xss Special condition: none Impact : semi-critical ------------------------------------------------------- 1 Introduction 2 Bug 3 Proof of concept 4 Credits =========== 1 Introduction =========== GreenSQ...

CVE-2007-5059: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GreenSQL allow remote attackers to inject arbitrary web script or HTML via several vectors, as demonstrated by the 1 uname and 2 pass parameters in a login form, and 3 an unspecified "url value," leading to storage of XSS sequences in the...

Black Lily 2007 - products.php?class SQL Injection

Black Lily 2007 - products.php?class SQL Injection SnIper-sa.com SSSSS nnn nn ii ppppppp eeeeeeeee rrrrr ss nn nn nn ii pp p ee rr rr s nn nn nn ii pp p ee rr r ss nn nn nn ii ppppppp ee rr rr sssss nn nn nn ii pp eeeeee rrrr ss nn nn nn ii pp ee rrrr s nn nn nn ii pp ee rr rr ss nn nnn ii pp ee ...

Black Lily 2007 - 'products.php?class' SQL Injection

SnIper-sa.com SSSSS nnn nn ii ppppppp eeeeeeeee rrrrr ss nn nn nn ii pp p ee rr rr s nn nn nn ii pp p ee rr r ss nn nn nn ii ppppppp ee rr rr sssss nn nn nn ii pp eeeeee rrrr ss nn nn nn ii pp ee rrrr s nn nn nn ii pp ee rr rr ss nn nnn ii pp ee rr rr sssss nn nnn ii pp eeeeeeeeee rr rr VerY-SecR...