Matrimony 2.7 Cross Site Request Forgery

======================================================== Matrimony 2.7 Admin account takeover Cross site request forgery Description : change password functionality in the admin panel does not check for current password and no CSRF token in place which allow an Attackers to be able to completely...

ICAutosales 1.2 SQL Injection

Title: ICAutosales v1.2 - SQL Injection Credit: Bilal KARDADOU Vendor: http://www.icloudcenter.com Vendor URL: http://www.icloudcenter.com/auto-dealer-car-sales-script.htm Product: AUTO DEALER CAR SALES PHP SCRIPT. Google Dork: N/A Product & Service Introduction: ICAutosales is a powerful, highly...

Redaxo 5.2.0: Remote Code Execution via CSRF

RIPS Analysis When inspecting the charts generated by RIPS, a code execution vulnerability indicated as critical catches our eye. Investigating this issue closer quickly reveals that the vulnerability lies in the administrator panel, seemingly nulling the severity of the vulnerability. We will se...

RCE via CSRF in osCmax

High-Tech Bridge Security Research Lab discovered 2 PHP Local File Inclusion vulnerabilities in osCmax, a popular web-based e-commerce application and shopping cart. The vulnerabilities can be exploited to execute arbitrary PHP code on the target system. Successful exploitation of these...

Dogma India dogmaindia CMS - Auth Bypass Vulnerability

Document Title: =============== Dogma India dogmaindia CMS - Auth Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1583 Release Date: ============= 2015-08-25 Vulnerability Laboratory ID VL-ID: ==================================== 158...

Virtual Freer v1.57 - Authentication Bypass Vulnerability

Document Title: =============== Virtual Freer v1.57 - Authentication Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1592 Release Date: ============= 2015-09-03 Vulnerability Laboratory ID VL-ID: ====================================...

kusaba x <= 0.9.1 - Multiple Vulnerabilities

No description provided by source. KusabaX XSS and CSRF Vulnerabilites Product: KusabaX and various Futaba channels clone Vendor site: http://kusabax.cultnet.net/ Affected versions: KusabaX = 0.9.1 Product description: an imageboard is a web application written in PHP used in sites like 4chan as ...

SiteEngine <= 7.1 - SQL Injection Vulnerability

No description provided by source. Title: SiteEngine 7.1 SQL injection Vulnerability Date: 2010-11-25 Author: Beach Team: www.linux520.com Vendor: www.siteengine.net www.boka.cn Dork: Powered by SiteEngine //300,000 + Language:PHP Greetz: birdarmy Description: Exploit this vulnerability comment...

BarracudaDrive 6.7.2 Cross Site Scripting

Exploit Title : BarracudaDrive 6.7.2 Administrator Panel Rflected Cross-Site Scripting Author : Govind Singh aka NullCool Vendor : http://barracudadrive.com Software : BarracudaDrive 6.7.2 Date : 15/06/2014 Discovered At : IHT Lab 1ND14N H4X0R5 T34M Love to : error1046, DeadMan India,...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in organizer/page/users.php in the Organizer plugin 1.2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 deleteid parameter or 2 extension parameter in an "Update Setting" action to wp-admin/admin.php...

Calendar Script Easy Membership Management Application Persistent XSS Vulnerability

Exploit for php platform in category web applications Advisory:Calendar Script Easy Membership Management ApplicationE.M.M.A Persistent XSS Vulnerability Version:1.2 Vendor URL: http://calendarscripts.info/emma/ Demo Link: http://demo.pimteam.net/emma/admin.php Author: Viknesvaran Sittaramane...

Joomla iCagenda SQL Injection / Path Disclosure

Souhail Hammou - Independant Security Researcher & Penetration Tester . Facebook : www.facebook.com/dark.puzzle.sec E-mail : [email protected] Greetings to all moroccan researchers and white hats . ------------------------------------------------------------------------------ Exploit Title:...

Cross site scripting

Cross-site scripting XSS vulnerability in service/graphhtml.php in the administrator panel in LiteSpeed Web Server 4.1.11 allows remote attackers to inject arbitrary web script or HTML via the gtitle parameter...

ColdFusion Zero day vulnerability : Remote File Disclosure of Password Hashes

ColdFusion Zero day vulnerability : Remote File Disclosure of Password Hashes Yesterday Blackhatacademy Released Fully automated MySQL5 boolean based enumeration tool. Today Another post expose the most critical ColdFusion vulnerability affects about a tenth of all ColdFusion servers at the...

Kusaba X <= 0.9.1 Multiple Vulnerabilities

Exploit for php platform in category web applications KusabaX XSS and CSRF Vulnerabilites Product: KusabaX and various Futaba channels clone Vendor site: http://kusabax.cultnet.net/ Affected versions: KusabaX " ----------------------------------------------------- Attackers can exploit these...

SiteEngine <= 7.1 SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= SiteEngine = 7.1 SQL Injection Vulnerability ============================================= Title: SiteEngine 7.1 SQL injection Vulnerability Date: 2010-11-25 Author: Beach Team: www.linux520.com...

SiteEngine 7.1 - SQL Injection

SiteEngine 7.1 - SQL Injection Title: SiteEngine 7.1 SQL injection Vulnerability Date: 2010-11-25 Author: Beach Team: www.linux520.com Vendor: www.siteengine.net www.boka.cn Dork: "Powered by SiteEngine" //300,000 + Language:PHP Greetz: birdarmy Description: Exploit this vulnerability comment mus...

SiteEngine 7.1 - SQL Injection

Title: SiteEngine 7.1 SQL injection Vulnerability Date: 2010-11-25 Author: Beach Team: www.linux520.com Vendor: www.siteengine.net www.boka.cn Dork: "Powered by SiteEngine" //300,000 + Language:PHP Greetz: birdarmy Description: Exploit this vulnerability comment must be enabled default == enable...

e-webtech (page.asp) IMPROVED SQL Injection Vulnerability

Exploit for php platform in category web applications ========================================================= e-webtech page.asp IMPROVED SQL Injection Vulnerability ========================================================= Author: s1ayer Mail: email protected Script Name: e-webtech Dork: "Powe...

e-webtech - 'page.asp' SQL Injection

------------------------------------------------------------------------------------------- e-webtech page.asp SQL Injection Vulnerability ------------------------------------------------------------------------------------------- Author: CoBRa21 Mail: [email protected] Script Name: e-webtec...