SQL Injection in b2evolution

Advisory ID: HTB23152 Product: b2evolution Vendor: b2evolution Group Vulnerable Versions: 4.1.6 and probably prior Tested Version: 4.1.6 Vendor Notification: April 10, 2013 Vendor Patch: April 29, 2013 Public Disclosure: May 1, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference:...

b2evolution 4.1.6 SQL Injection Vulnerability

b2evolution version 4.1.6 suffers from remote SQL injection and cross site request forgery vulnerabilities. Product: b2evolution Vendor: b2evolution Group Vulnerable Versions: 4.1.6 and probably prior Tested Version: 4.1.6 Vendor Notification: April 10, 2013 Vendor Patch: April 29, 2013 Public...

b2evolution 4.1.6 SQL Injection

Advisory ID: HTB23152 Product: b2evolution Vendor: b2evolution Group Vulnerable Versions: 4.1.6 and probably prior Tested Version: 4.1.6 Vendor Notification: April 10, 2013 Vendor Patch: April 29, 2013 Public Disclosure: May 1, 2013 Vulnerability Type: SQL Injection CWE-89 CVE Reference:...

SQL Injection in b2evolution

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in b2evolution, which can be exploited to alter SQL requests passed to the vulnerable application's database. 1 SQL Injection in b2evolution: CVE-2013-2945 The vulnerability exists due to insufficient validation of HTTP...

CVE-2012-5910

SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter...

CVE-2012-5911

Cross-site scripting XSS vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body...

Cross site scripting

Cross-site scripting XSS vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body...

Sql injection

SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter...

CVE-2012-5910

CVE-2012-5910 is a SQL injection in blogs/htsrv/viewfile.php of b2evolution 4.1.3. An authenticated remote user can inject SQL via the root parameter to execute arbitrary commands. Impact is partial confidentiality/integrity/availability as stated; attack vector is web-based with single-privilege...

CVE-2012-5911

Cross-site scripting XSS vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body...

CVE-2012-5911

CVE-2012-5911: XSS in b2evolution 4.1.3 (blogs/blog1.php) allows remote attackers to inject arbitrary script via the message body. No remediation details are provided in the supplied documents.

CVE-2012-5911: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in blogs/blog1.php in b2evolution 4.1.3 allows remote attackers to inject arbitrary web script or HTML via the message body...

PT-2012-6192

Name of the Vulnerable Software and Affected Versions b2evolution version 4.1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the message body in blogs/blog1.php. Recommendations For version 4.1.3, updat...

CVE-2012-5910: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in blogs/htsrv/viewfile.php in b2evolution 4.1.3 allows remote authenticated users to execute arbitrary SQL commands via the root parameter...

PT-2012-6191

Name of the Vulnerable Software and Affected Versions b2evolution version 4.1.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the root parameter in the /blogs/htsrv/viewfile.php API endpoint. Recommendations For version 4.1.3,...

B2Evolution CMS 4.1.3 - Multiple Web Vulnerabilities

Document Title: =============== B2Evolution CMS 4.1.3 - Multiple Web Vulnerabilities References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=482 Release Date: ============= 2012-03-28 Vulnerability Laboratory ID VL-ID: ==================================== 482 Produc...

B2Evolution CMS 4.1.3 - Multiple Web Vulnerabilities

Document Title: =============== B2Evolution CMS 4.1.3 - Multiple Web Vulnerabilities References Source: ==================== http://vulnerability-lab.com/getcontent.php?id=482 Release Date: ============= 2012-03-28 Vulnerability Laboratory ID VL-ID: ==================================== 482 Produc...

CVE-2011-3709

b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ruRU/ru-RU.locale.php and certain other files...

CVE-2011-3709

b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ruRU/ru-RU.locale.php and certain other files...

Information disclosure

b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ruRU/ru-RU.locale.php and certain other files...