BoastMachine v3.0 platinum - Session Эd Hacking

Vagrant - E-hack.org 05.22.2007 BoastMachine v3.0 platinum - Session Id Hacking After the login into the site which alllows new user registration. Site user's data which is entered to change the topic, can be changed by another user, and that is a security hole because of ID interchangeability in...

BoastMachine 3.1 - index.php Cross-Site Scripting

BoastMachine 3.1 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/24156/info BoastMachine is prone to a cross-site scripting vulnerability. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of...

BoastMachine 3.1 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24156/info BoastMachine is prone to a cross-site scripting vulnerability. Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker m...

Deserialization of untrusted data

user.php in BoastMachine 3.0 platinum allows remote authenticated users to gain privileges via a modified id parameter, as demonstrated by an editpost action...

CVE-2007-2860

user.php in BoastMachine 3.0 platinum allows remote authenticated users to gain privileges via a modified id parameter, as demonstrated by an editpost action...

CVE-2007-2860

user.php in BoastMachine 3.0 platinum allows remote authenticated users to gain privileges via a modified id parameter, as demonstrated by an editpost action...

CVE-2007-2860

Summary (CVE-2007-2860): BoastMachine 3.0 platinum’s user.php allows privilege escalation for remote authenticated users by tampering the id parameter, as demonstrated by an edit_post action. The NVD entry lists a network attack with low complexity and partial confidentiality/integrity/availabili...

boastmachine-session.txt

Vagrant - E-hack.org 05.22.2007 BoastMachine v3.0 platinum - Session Ýd Hacking After the login into the site which alllows new user registration. Site user's data which is entered to change the topic, can be changed by another user, and that is a security hole because of ID interchangeability in...

boastmachine31-rfi.txt

AuThor:Silitoad emA!l:SilitoadathotmaildotCom HoMePaGe:http://www.Arabian-FighterZ.com Powered By Silitoad From Arabian-Fighterz Info cms:boastMachine v3.1 website:http://boastology.com download:http://boastology.com/pages/dload.php?id=bmachine-3.1.zip bug: GENERAL/COMMON FUNCTIONS includeonce...

CVE-2006-3827

SQL injection vulnerability in bmc/Inc/core/admin/search.inc.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the blog parameter...

CVE-2006-3826

CVE-2006-3826: XSS in Kailash Nadh boastMachine (3.1 and earlier) allows remote injection via register.php parameters (user_login, full_name, URL) and via admin interface parameters (cat_list, key); no exploitation status or patch details are provided in the connected documents.

CVE-2006-3828

The CVE-2006-3828 entry concerns Kailash Nadh’s boastMachine (formerly bMachine)

CVE-2006-3829

Cross-site request forgery CSRF vulnerability in bmc/admin.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote attackers to perform unauthorized actions as an administrator and delete arbitrary user accounts via a deleteuser action...

CVE-2006-3828

Incomplete blacklist vulnerability in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to bypass SQL injection protection mechanisms by using commas, quote characters, pound sign characters, "UNION," and "SELECT," which are not filtered by the...

CVE-2006-3827

SQL injection vulnerability in bmc/Inc/core/admin/search.inc.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the blog parameter...

CVE-2006-3831

The CVE-2006-3831 issue affects Kailash Nadh boastMachine (formerly bMachine) versions up to 3.1. The backup feature creates database backups with predictable filenames and stores them under the web root with insufficient access controls, enabling remote attackers to download a backup file and ob...

CVE-2006-3829

CVE-2006-3829 affects Kailash Nadh boastMachine (formerly bMachine) up to version 3.1 and earlier. The issue is a Cross-site request Forgery (CSRF) in bmc/admin.php that allows remote attackers to perform actions as an administrator and delete arbitrary user accounts via a delete_user action. The...

CVE-2006-3827

The CVE-2006-3827 entry affects Kailash Nadh’s boastMachine (formerly bMachine) up to v3.1. The issue is an SQL injection in bmc/Inc/core/admin/search.inc.php, exploitable by remote authenticated administrators via the blog parameter. This is caused by unsanitized input being used in SQL queries,...

boastMachineSQL.txt

!/usr/bin/perl VulnScr: boastMachine version 3.1 and prior Web: http://boastology.com/ Date: Sun July 16 10:43 PM 2006 Credits: DarkFig [email protected] Vuln: SQL Injection, Cross Site Scripting, Cross Site Request Forgery, Predictable Backup Filename Advisory:...

boastMachine.txt

SaVSaK.CoM | SpC-x - The-BeKiR | boastMachine v3.1 Version - Remote File Include Vulnerabilities Risk : High Class: Remote Script : boastMachine Credits : SpC-x Thanks : The-BeKiR - Ejder - FasTBoY - ERNE - RMx - Nukedx - Str0ke Code : includeonce dirnameFILE."/config.php"; includeonce...