Play! Framework 1.0.3.1 Directory Traversal

Exploit Title: Play! Framework = 1.0.3.1 Directory Transversal Vulnerability Date: July 24, 2010 Author: kripthor Software Link: http://www.playframework.org/ Version: Play! Framework = 1.0.3.1 Tested on: Ubuntu 10 CVE : N/A Notes: 28/07/2010 at 14:03 - Developer contacted 28/07/2010 at 15:04 - F...

Joomla Teams SQL Injection

Teams 110281008091711 Joomla Component Multiple Blind SQL Injection Vulnerabilities Name Teams Vendor http://www.joomlamo.com Versions Affected 110281008091711 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-08-10 X...

Allinta CMS 22.07.2010 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/42320/info Allinta CMS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these vulnerabilities could allow an attacker to steal...

XSS vulnerability in SiteLoom CMS

Vulnerability ID: HTB22516 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinsiteloomcms.html Product: SiteLoom CMS Vendor: SiteLoom ApS http://www.siteloom.dk/ Vulnerable Version: Current at 21.07.2010 and Probably Prior Versions Vendor Notification: 22 July 2010 Vulnerability Type: X...

Tycoon Record Script 1.0.9 SQL Injection

% TycoonCMS Record Script Sql vulnerability ------------------------------------------------------------------------------- 0 | | | | | | TM 1 | | | | | | 0 | / | ' \ / | ' \ / |/ | |/ / \ '| ' \ / \ | 1 / / | | | | / | | | | | | | Exploit---------------------------------- 0x1: Goto...

Open Blog 1.2.1 Cross Site Request Forgery / Cross Site Scripting

============================================== Vulnerability ID: HTB22498 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinopenblog1.html Product: Open Blog Vendor: Tomaž Muraus http://www.open-blog.info/ Vulnerable Version: 1.2.1 and Probably Prior Versions Vendor Notification: 22 Ju...

Hulihan Applications BXR 0.6.8 - SQL Injection HTML Injection

Hulihan Applications BXR 0.6.8 - SQL Injection HTML Injection source: https://www.securityfocus.com/bid/42247/info Hulihan Applications BXR is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. An...

KVIrc 4.0 - \r Carriage Return in DCC Handshake Remote Command Execution

KVIrc 4.0 - \r Carriage Return in DCC Handshake Remote Command Execution source: https://www.securityfocus.com/bid/42026/info KVIrc is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting this issue can allow an...

PunBB 1.3.4 Pun_PM 1.2.6 - Blind SQL Injection

PunBB 1.3.4 PunPM 1.2.6 - Blind SQL Injection !/usr/bin/perl 0-Day PunBB 526 function punpmeditmessage global $forumdb, $forumuser, $langpunpm; $errors = array; // Verify input data $query = array 'SELECT' = 'm.id as id, m.senderid as senderid, m.status as status, u.username as username, m.subjec...

SyndeoCMS 2.9 - Multiple HTML Injection Vulnerabilities

SyndeoCMS 2.9 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/41989/info SyndeoCMS is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content...

How Mass SQL Injection Attacks Became an Epidemic

In the first few months of 2009, security researchers began seeing signs of a new piece of malware that was somewhat baffling to them. It didn’t act like other Trojans or rootkits and try to bury itself on an infected machine and try to do nasty stuff like deleting registry keys or copying the...

SnowFlake CMS 0.9.5 Beta - 'uid' SQL Injection

source: https://www.securityfocus.com/bid/41791/info SnowFlake CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

XSS vulnerability in FestOS

Vulnerability ID: HTB22473 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinfestos1.html Product: FestOS Vendor: Skypanther Studios, Inc http://festengine.org/ Vulnerable Version: 2.3b and Probably Prior Versions Vendor Notification: 01 July 2010 Vulnerability Type: Stored XSS Cross...

Absolute Shopping cart (company.asp) sql Injection Vulnerability

Exploit for asp platform in category web applications ================================================================ Absolute Shopping cart company.asp sql Injection Vulnerability ================================================================ Exploit Title: Absolute Shopping cartcompany.asp s...

VUPEN Security Research - Winamp Player FLV Data Processing Multiple Overflow Vulnerabilities

VUPEN Security Research - Winamp Player FLV Data Processing Multiple Overflow Vulnerabilities http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Winamp is a proprietary media player for Windows-based PCs, written by Nullsoft, now a subsidiary of AOL. It is...

XSS vulnerability in Diem

Vulnerability ID: HTB22459 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityindiem1.html Product: Diem Vendor: Diem team Vulnerable Version: 5.1.2 and Probably Prior Versions Vendor Notification: 29 June 2010 Vulnerability Type: XSS Cross Site Scripting Status: Not Fixed, Vendor Alerted...

Campsite CMS 3.4.0 Cross Site Request Forgery

Date: Mon 12 Jul 2010 03:40:46 PM EEST Vendor: http://www.sourcefabric.org/en/home/web/6/Campsite.htm?tpl=18 Download: http://sourceforge.net/projects/campsite/files/campsite/3.4.0/campsite-3.4.0.tar.gz/download --- -= CSRF PoC 1 - Create Admin User =- Campsite CMS 3.4.0 Multiple CSRF...

ClanTiger Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications ======================================= ClanTiger Multiple CSRF Vulnerabilities ======================================= Exploit Title: ClanTiger 1.3 Multiple CSRF, delete user, shoutbox items, news, ??? ban/unban user, delete forum etc. Date: ...

Sandbox Multiple Remote Vulnerabilities

Sandbox is prone to multiple remote vulnerabilities, including multiple SQL-injection vulnerabilities, a local file-include vulnerability, and multiple arbitrary-file-upload vulnerabilities. Exploiting these issues could allow an attacker to upload and execute arbitrary code within the context of...

Sandbox Multiple Remote Vulnerabilities

Sandbox is prone to multiple remote vulnerabilities, including multiple SQL-injection vulnerabilities, a local file-include vulnerability, and multiple arbitrary-file-upload vulnerabilities. Exploiting these issues could allow an attacker to upload and execute arbitrary code within the context of...