HTB22912: Multiple SQL Injections in Eleanor CMS

Vulnerability ID: HTB22912 Reference: http://www.htbridge.ch/advisory/multiplesqlinjectionsineleanorcms.html Product: Eleanor CMS Vendor: Eleanor CMS http://eleanor-cms.ru/ Vulnerable Version: rc5 Vendor Notification: 22 March 2011 Vulnerability Type: SQL Injection Status: Fixed by Vendor Risk...

Advanced Image Hosting 2.2 (index.php) SQL Injection Vulnerability

Exploit for php platform in category web applications InformatioN Title : Advanced Image Hosting v2.2 SQLi Vulnerability Author : keracker Vendor or Software Link : http://yabsoft.com Email : email protected Data : 2011-04-01 Google dork: "Powered by: AIH v2.2" Category: Webapps Tested on: Window...

CAT – Web Application Security Test & Assessment Tool

CAT is designed to facilitate manual web application penetration testing for more complex, demanding application testing tasks. It removes some of the more repetitive elements of the testing process, allowing the tester to focus on individual applications, thus enabling them to conduct a much mor...

The Challenge of Starting an Application Security Program

Since organizations started opening their internal applications to the Web, a little more than a decade ago, it became clear that the security of those connected applications would be more complex – and critical to get right – than before. Unfortunately, through complacency, perhaps a feeling tha...

Profile picture thumbnail generation can consume unlimited amount of memory

Discovered a Studio customer, you can upload a very large profile picture to expose the same problem as CONF-21480, just in a different area of the application. We should limit the size of images we're willing to load into memory to avoid this problem with user pictures...

Joomla! 1.6 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/46846/info Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...

Apache Tomcat 7.0.x < 7.0.11 Security Bypass Vulnerability

Binary data 5816.pasl...

Cosmoshop 10.05.00 - Multiple Cross-Site Scripting / SQL Injections

source: https://www.securityfocus.com/bid/46828/info CosmoShop is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to steal...

WS Interactive Automne 4.1 - adminupload-controler.php Arbitrary File Upload

WS Interactive Automne 4.1 - adminupload-controler.php Arbitrary File Upload source: https://www.securityfocus.com/bid/46774/info Automne is prone to an arbitrary-file-upload vulnerability. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in...

Moodle Prior to 1.9.11/2.0.2 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities, including: 1. Multiple cross-site scripting issues 2. Multiple information-disclosure issues 3. An HTML-injection issue 4. An insecure permissions issue Attackers can exploit these issues to bypass certain security restrictions, obtain sensitive...

CGI Generic XSS (persistent, 3rd Pass)

The remote web server hosts one or more CGI scripts that fail to adequately sanitize request strings containing malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the...

DivX Player 6.x - '.dps' Remote Buffer Overflow

source: https://www.securityfocus.com/bid/46609/info DivX Player is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input. Attackers may leverage this issue to execute arbitrary code in the context of the...

WordPress Plugin IWantOneButton 3.0.1 - Multiple Vulnerabilities

Vulnerability ID: HTB22846 Reference: http://www.htbridge.ch/advisory/sqlinjectioniniwantonebuttonwordpres splugin.html Product: IWantOneButton wordpress plugin Vendor: Daniel Sands http://www.danielsands.co.cc/ Vulnerable Version: 3.0.1 Vendor Notification: 10 February 2011 Vulnerability Type: S...

eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting

eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting Exploit Title: Eventum 2.3.1 stored XSS Date: 19-2-2011 Author: Saif El-Sherei Software Link: https://code.launchpad.net/eventum Version: Eventum 2.3.1 Tested on: FF 3.0.15, IE 8 Vendor notification: vendor notified, awaiting...

In Application Security, Good Enough Isn't

SAN FRANCISCO–There’s the old joke about two hunters running from a lion, and the one runner says to the other: we can’t outrun the lion. And his buddy replied, “I don’t have to outrun the lion, I only have to outrun you.” Many, over the years, have applied the same logic to application security:...

It's Time to Move Away From the Build or Break Mentality

SAN FRANCISCO–The vulnerability disclosure and patching arms race that has developed in the last decade or so in the security industry has made life extremely difficult not just for the developers writing code, but also for the folks who are interested in helping to fix broken applications. A new...

SQL Injection Vulnerabilities in WP Forum wordpress plugin

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in WP Forum wordpress plugin which could be exploited to perform SQL injection attacks. 1 SQL injection vulnerabilities in WP Forum wordpress plugin 1.1 The vulnerability exists due to input sanitation error in the...

Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

WP Forum Server 1.6.5 SQL Injection

================================= Vulnerability ID: HTB22852 Reference: http://www.htbridge.ch/advisory/sqlinjectioninwpforumserverwordpressplugin2.html Product: WP Forum Server wordpress plugin Vendor: VastHTML http://lucidcrew.com/ Vulnerable Version: 1.6.5 Vendor Notification: Vulnerability...

Escortservice 'custid' Parameter SQL Injection Vulnerability

Escortservice is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the...