BtiTracker 1.4.7 / xbtit 2.0.542 - SQL Injection

BtiTracker/xBtiTracker Remote SQL Injection Vulnerability Author: InATeam http://inattack.ru/ Affected versions: BtiTracker = 1.4.7, xBtiTracker = 2.0.542 Software site: http://www.btiteam.org/ ============================================================================== Exploit:...

BtiTracker <= 1.4.7, xbtit <= 2.0.542 SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================= BtiTracker = 1.4.7, xbtit = 2.0.542 SQL Injection Vulnerability ================================================================= BtiTracker/xBtiTracker Remote SQL Injection...

BtiTracker &lt;= 1.4.7 xbtit &lt;= 2.0.542 SQL Injection Vulnerability

No description provided by source. BtiTracker/xBtiTracker Remote SQL Injection Vulnerability Author: InATeam http://inattack.ru/ Affected versions: BtiTracker = 1.4.7, xBtiTracker = 2.0.542 Software site: http://www.btiteam.org/...

BtiTracker 1.4.7 xbtit 2.0.542 - SQL Injection

BtiTracker 1.4.7 xbtit 2.0.542 - SQL Injection BtiTracker/xBtiTracker Remote SQL Injection Vulnerability Author: InATeam http://inattack.ru/ Affected versions: BtiTracker = 1.4.7, xBtiTracker = 2.0.542 Software site: http://www.btiteam.org/...

Sql injection

SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Design/Logic Flaw

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 account.php, 2 moresmiles.php, or 3 recover.php; or 4 the "to" parameter to usercp.php...

CVE-2007-5986

SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2007-5985

Multiple cross-site scripting XSS vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 account.php, 2 moresmiles.php, or 3 recover.php; or 4 the "to" parameter to usercp.php...

CVE-2007-5987

details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by 1 reading the details of an arbitrary torrent and 2 modifying a torrent owned by a guest...

CVE-2007-5988

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

Design/Logic Flaw

details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by 1 reading the details of an arbitrary torrent and 2 modifying a torrent owned by a guest...

CVE-2007-5985

CVE-2007-5985: Multiple XSS vulnerabilities in BtiTracker prior to 1.4.5 allow remote attackers to inject arbitrary script/HTML via unspecified vectors to account.php, moresmiles.php, recover.php, or via the to parameter in usercp.php. The NVD entry confirms the same description, with a base scor...

CVE-2007-5986

SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2007-5987

The CVE-2007-5987 issue affects BtiTracker prior to 1.4.5. It allows remote attackers to bypass access protections via direct requests to details.php when guest torrent viewing is disabled, enabling reading torrent details and potentially modifying a torrent owned by a guest. Root cause is improp...

CVE-2007-5987: Improper Authentication

details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by 1 reading the details of an arbitrary torrent and 2 modifying a torrent owned by a guest...

CVE-2007-5986: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2007-5985: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 account.php, 2 moresmiles.php, or 3 recover.php; or 4 the "to" parameter to usercp.php...

CVE-2007-5988: Improper Authentication

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

CVE-2007-5988

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...