217 matches found
CVE-2008-6180
SQL injection vulnerability in system/nlbuser.class.php in NewLife Blogger 3.0 and earlier, and possibly 3.3.1, allows remote attackers to execute arbitrary SQL commands via the nlb3 cookie...
Design/Logic Flaw
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. NOTE: this is only a vulnerability when the administrator does not properly follow installation directions...
CVE-2009-0403
SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...
CVE-2009-0399
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. NOTE: this is only a vulnerability when the administrator does not properly follow installation directions...
Sql injection
SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...
CVE-2009-0399
Chipmunk Blogger Script is affected by CVE-2009-0399. The vulnerability allows remote attackers to gain administrator privileges by issuing a direct request to admin/reguser.php. This is described as a privilege escalation in the affected script, contingent on the administrator not properly follo...
CVE-2009-0403
SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...
CVE-2009-0403
CVE-2009-0403 concerns a SQL injection vulnerability in the Chipmunk Blogger Script, specifically in admin/authenticate.php. The flaw allows remote attackers to inject SQL commands through the (1) username and (2) password parameters, enabling arbitrary SQL execution. The connected documents prov...
CVE-2009-0399
Chipmunk Blogger Script allows remote attackers to gain administrator privileges via a direct request to admin/reguser.php. NOTE: this is only a vulnerability when the administrator does not properly follow installation directions...
NewLife Blogger <= v3.0 / Insecure Cookie Handling & SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NewLife Blogger = v3.0 / Insecure Cookie Handling & SQL Injection Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= $ Program: NewLife Blogger $ Version: = 3.0 $ File...
newlife-cookiesql.txt
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NewLife Blogger eNYe-Sec - www.enye-sec.org Cookie format is: nlb3=7::96e79218965eb72c92a549dd5a330112 nlb3=iduser::md5 pass --Bug -- 143. function checkLogin 144. // loing check 145. if isset $COOKIE'nlb3' 146. $dat...
NewLife Blogger 3.0 - Insecure Cookie Handling / SQL Injection
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NewLife Blogger eNYe-Sec - www.enye-sec.org Cookie format is: nlb3=7::96e79218965eb72c92a549dd5a330112 nlb3=iduser::md5 pass --Bug -- 143. function checkLogin 144. // loing check 145. if isset $COOKIE'nlb3' 146. $dat...
NewLife Blogger 3.0 - Insecure Cookie Handling SQL Injection
NewLife Blogger 3.0 - Insecure Cookie Handling SQL Injection -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NewLife Blogger eNYe-Sec - www.enye-sec.org Cookie format is: nlb3=7::96e79218965eb72c92a549dd5a330112 nlb3=iduser::md5 pass --Bug -- 143. function...
NewLife Blogger <= 3.0 Insecure Cookie Handling / SQL Injection Vuln
No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= NewLife Blogger = v3.0 / Insecure Cookie Handling & SQL Injection Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= $ Program: NewLife...
NewLife Blogger <= 3.0 Insecure Cookie Handling / SQL Injection Vuln
Exploit for unknown platform in category web applications ==================================================================== NewLife Blogger eNYe-Sec - www.enye-sec.org Cookie format is: nlb3=7::96e79218965eb72c92a549dd5a330112 nlb3=iduser::md5 pass --Bug -- 143. function checkLogin 144. // loi...
[ECHO_ADV_100$2008] Comdev Web Blogger <= 4.1.3 (arcmonth) Sql Injection Vulnerability
.OR.ID ECHOADV100$2008 ----------------------------------------------------------------------------------------- ECHOADV100$2008 Comdev Web Blogger = 4.1.3 arcmonth Sql Injection Vulnerability ----------------------------------------------------------------------------------------- Author :...
Comdev Web Blogger 'arcmonth' SQL注入漏洞
BUGTRAQ ID: 30237 CNCAN ID：CNCAN-2008071601 Comdev Web Blogger是一款基于PHP的WEB应用程序。 Comdev Web Blogger不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于脚本对用户提交给'arcmonth'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Comdev Web Blogger 4.1.3 目前没有解决方案提供： http://www.comdevweb.com/blogger.php...
Comdev Web Blogger <= 4.1.3 (arcmonth) Sql Injection Vulnerability
No description provided by source. \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV100$2008 ----------------------------------------------------------------------------------------- ECHOADV100$2008 Comdev Web Blogger = 4.1.3 arcmonth Sql Injection...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Chipmunk Blog Blogger allow remote attackers to inject arbitrary web script or HTML via the membername parameter to 1 members.php, 2 comments.php, 3 photos.php, 4 archive.php, or 5 cat.php. NOTE: the provenance of this information is unknown; t...
CVE-2008-3186
Chipmunk Blog (Blogger) contains cross-site scripting (XSS) vulnerabilities in the membername parameter of five PHP scripts (members.php, comments.php, photos.php, archive.php, cat.php). Root cause: improper handling of user-supplied membername leads to script/HTML injection. Impact: allows remot...