TutorialCMS <= 1.00 (search.php search) SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w TutorialCMS = 1.00 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code search.php: $search = $REQUEST'search'; $sql = SELECT FROM tutorials WHERE title LIKE...

TaskDriver <= 1.2 Login Bypass/SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w TaskDriver = 1.2 Login Bypass/SQL Injection Exploit Discovered by: Silentz Payload: Login Bypass & Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code login.php: $sql = SELECT FROM $userstable WHERE username =...

phpStat <= 1.5 (setup.php) Authentication Bypass Exploit (php 2)

No description provided by source. ? / PHP Stat Administrative User Authentication Bypass POC Exploit Code by Nikyt0x - Soulblack Security Research Advisory: http://www.soulblack.com.ar/repo/papers/phpstatadvisory.txt Saludos: Soulblack Staff, Status-x, NeosecurityTeam, KingMetal, SWP,...

Active PHP Bookmarks 1.3 - SQL Injection Vulnerability

No description provided by source. Title: Active PHP Bookmarks v1.3 Remote SQL Injection Vulnerability EDB-ID: CVE-ID: OSVDB-ID: Author: Mr.Elgaarh Published: 2009-12-21 ============================================================= Author : Mr.Elgaarh Email : [email protected] Home :...

SimpleNews <= 1.0.0 FINAL (print.php news_id) SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w SimpleNews = 1.0.0 FINAL SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code print.php: $newsid = $GET'newsid'; $query = SELECT FROM simplenewsarticles WHERE news...

OpenLD <= 1.2.2 (index.php id) Remote SQL Injection Vulnerability

No description provided by source. --==+================================================================================+==-- --==+ OpenLD = 1.2.2 SQL Injection Exploit +==-- --==+================================================================================+==-- DISCOVERED BY: Cody CypherXero...

FaScript FaPhoto 1.0 - (show.php id) SQL Injection Vulnerability

No description provided by source. AUTHOR : IRCRASH Dr.Crash Script Download : http://en.fascript.com/en.faphoto.zip Injection Adress : http://Sitename/faname/show.php?id=SqL Code Help : In This Script Admin Username and Password Save in ./admin/pconfig.php You can open this file with loadfile...

PHPJabbers Job Listing脚本多个漏洞

No description provided by source. Job Listing Script - Multiple Vulnerabilties ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

Belkin WiFi NetCam video stream backdoor with unchangeable admin/admin credentials

Product: Product NetCam WiFi Camera With Night Vision, purchased August 2013 Summary: Live video stream is accessible with user/password of admin/admin. The user/password combination admin/admin cannot be changed by the user. This "feature" is undocumented. To reproduce: 1. Connect webcam to...

Buffalo WZR-HP-G300NH2 Cross Site Request Forgery

Exploit Title: Buffalo WZR-HP-G300NH2 CSRF Vulnerability Author: Prayas Kulshrestha E-mail: [email protected] Category: Hardware Google Dork: N/A Date: 06/10/2013 Vendor: http://www.buffalotech.com Model: WZR-HP-G300NH2 Firmware Version: DD-WRT v24SP2-MULTI 10/31/11 std - build 17798...

vShare<=2.8.1 SQL injection + Remote Command Execution

Unvalidated input results in SQL injection, remote command execution is highly likely after the compromise of the Admin username because of the risky requirements of Video Sharing scripts. I haven't attached a Video because it will disclose the SQL Injection location and posting a blank Video is...

MyBB DyMy User Agent Plugin - newreply.php SQL Injection

MyBB DyMy User Agent Plugin - newreply.php SQL Injection Exploit title : MyBB DyMy User Agent Plugin SQL injection vulnerability. Author: JoinSe7en Date : 13 Dec 2012 Tested on : Linux Category : Web Applications Software Link : http://mods.mybb.com/view/dymy-user-agent PoC receive admin username...

MyBB DyMy User Agent SQL Injection

Exploit title : MyBB DyMy User Agent Plugin SQL injection vulnerability. Author: JoinSe7en Date : 13 Dec 2012 Tested on : Linux Category : Web Applications Software Link : http://mods.mybb.com/view/dymy-user-agent PoC receive admin username We fire up HTTP Live Headers or a similar tool, post...

MyBB DyMy User Agent Plugin - 'newreply.php' SQL Injection

Exploit title : MyBB DyMy User Agent Plugin SQL injection vulnerability. Author: JoinSe7en Date : 13 Dec 2012 Tested on : Linux Category : Web Applications Software Link : http://mods.mybb.com/view/dymy-user-agent PoC receive admin username We fire up HTTP Live Headers or a similar tool, post...

phpcms v9. 1. 1 5 sql and XSS exploits-vulnerability warning-the black bar safety net

phpcms v9. 1. 1 5 The official demo site has been updated to 9.1.16: the http://v9.demo.phpcms.cn/ XSS public function publicgetsuggestkeyword $url = $GET'url'.'& q='.$ GET'q'; echo $url; $res = @filegetcontents$url; ifCHARSET != 'gbk' $res = iconv'gbk', CHARSET, $res; echo $res; Use method:...

WordPress Zingiri Tickets File Disclosure

Title : WordPress Plugin Zingiri Tickets Author: MadLeeTs Greets: Shadow008,1337,Invectus,pSyCh03D,KhanTastiC,MadBuGz,H4x0rL1f3 Vendor: http://www.zingiri.com/plugins-and-addons/tickets/ Email : [email protected] WwW.MadLeeTs.CoM Date : 17/04/2012 Dork : "/wp-content/plugins/zingiri-tickets"...

Hua-speed online trading platform V13 full version more than the presence of injection vulnerabilities-vulnerability warning-the black bar safety net

Publishing author: wandering wind Affected versions: V13 Official website: http://www.hs173.cn Vulnerability type: SQL injection Vulnerability Description: The program is also the only anti-get and post two kinds of injection, then we can use the cookie injection, get admin username and password...

Log1 CMS 2.0 Cross Site Request Forgery

input type="hidden" name="pass" value="Pa...

Active PHP BookMarks 1.3 - SQL Injection

Title: Active PHP Bookmarks v1.3 Remote SQL Injection Vulnerability EDB-ID: CVE-ID: OSVDB-ID: Author: Mr.Elgaarh Published: 2009-12-21 ============================================================= Author : Mr.Elgaarh Email : [email protected] Home : http://securityreason.com/...

4images 1.7.1 Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================ 4images 1.7.1 Remote SQL Injection Vulnerability ================================================ Exploit Title: 4images 1.7.1 Remote SQL Injection Vulnerability Date: 20-12-2009 Author:...