CVE-2006-3831: Undefined Security Weakness

The Backup selection in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier uses predicable filenames for database backups and stores the files under the web root with insufficient access control, which allows remote attackers to obtain sensitive information by downloading a backup file...

CVE-2006-3828: Undefined Security Weakness

Incomplete blacklist vulnerability in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to bypass SQL injection protection mechanisms by using commas, quote characters, pound sign characters, "UNION," and "SELECT," which are not filtered by the...

CVE-2006-3826: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 userlogin, 2 fullname, and 3 URL parameters in register.php; and allow remote authenticated administrators to...

CVE-2006-3827: Undefined Security Weakness

SQL injection vulnerability in bmc/Inc/core/admin/search.inc.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the blog parameter...

CVE-2006-3830: Undefined Security Weakness

The Languages selection in the admin interface in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote authenticated administrators to upload files with arbitrary extensions to the bmc/Inc/Lang directory. NOTE: because the uploaded files cannot be accessed through HTTP, this...

CVE-2006-3829: Undefined Security Weakness

Cross-site request forgery CSRF vulnerability in bmc/admin.php in Kailash Nadh boastMachine formerly bMachine 3.1 and earlier allows remote attackers to perform unauthorized actions as an administrator and delete arbitrary user accounts via a deleteuser action...

CVE-2006-3831

The CVE-2006-3831 issue affects Kailash Nadh boastMachine (formerly bMachine) versions up to 3.1. The backup feature creates database backups with predictable filenames and stores them under the web root with insufficient access controls, enabling remote attackers to download a backup file and ob...

CVE-2006-3826

CVE-2006-3826: XSS in Kailash Nadh boastMachine (3.1 and earlier) allows remote injection via register.php parameters (user_login, full_name, URL) and via admin interface parameters (cat_list, key); no exploitation status or patch details are provided in the connected documents.

boastMachineSQL.txt

!/usr/bin/perl VulnScr: boastMachine version 3.1 and prior Web: http://boastology.com/ Date: Sun July 16 10:43 PM 2006 Credits: DarkFig [email protected] Vuln: SQL Injection, Cross Site Scripting, Cross Site Request Forgery, Predictable Backup Filename Advisory:...

boastMachine.txt

SaVSaK.CoM | SpC-x - The-BeKiR | boastMachine v3.1 Version - Remote File Include Vulnerabilities Risk : High Class: Remote Script : boastMachine Credits : SpC-x Thanks : The-BeKiR - Ejder - FasTBoY - ERNE - RMx - Nukedx - Str0ke Code : includeonce dirnameFILE."/config.php"; includeonce...

boastMachine v3.1 Version - Remote File Include Vulnerabilities

SaVSaK.CoM | SpC-x - The-BeKiR | boastMachine v3.1 Version - Remote File Include Vulnerabilities Risk : High Class: Remote Script : boastMachine Credits : SpC-x Thanks : The-BeKiR - Ejder - FasTBoY - ERNE - RMx - Nukedx - Str0ke Code : includeonce dirnameFILE."/config.php"; includeonce...

Boastmachine.txt

Advisory : Cross Site Scripting in Boastmachine http://boastology.com/ Release Date : 17/05/2005 Last Modified : 17/05/2005 Author : Yunus Emre Yilmaz http://yns.zaxaz.com Application : BoastMachine v3.1 maybe older versions Risk : High Problem : Form action values in admin.php and index.php mayb...

Cross site scripting

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

CVE-2006-2491

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

CVE-2006-2491

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

CVE-2006-2491

BoastMachine (bMachine) 3.1 and earlier is affected by CVE-2006-2491, a cross-site scripting (XSS) flaw in index.php and bmc/admin.php. The vulnerability arises because user-supplied data in the query string is not properly filtered when accessed via $_SERVER["PHP_SELF"], enabling remote attacker...

EUVD-2006-2491

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

CVE-2006-2491: Undefined Security Weakness

Cross-site scripting XSS vulnerability in 1 index.php and 2 bmc/admin.php in BoastMachine bMachine 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $SERVER"PHPSELF" variable...

BoastMachine 3.1 - admin.php Cross-Site Scripting

BoastMachine 3.1 - admin.php Cross-Site Scripting source: https://www.securityfocus.com/bid/18012/info BoastMachine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute...

BoastMachine 3.1 - 'admin.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/18012/info BoastMachine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the...