Pligg 9.9.5 Cross Site Request Forgery

Written By Michael Brooks Special thanks to str0ke! Pligg - XSRF Protection Bypass and Captcha Bypass affects 9.9.5 XSRF Protection Bypass ' width="0%" height="0%" var pliggstorytovotefor="/story.php?title=pliggxss"; function r var Z=false; ifwindow.XMLHttpRequest try Z=new XMLHttpRequest...

Pligg CMS 9.9.5 - Cross-Site Request Forgery Protection Bypass Captcha Bypass

Pligg CMS 9.9.5 - Cross-Site Request Forgery Protection Bypass Captcha Bypass Written By Michael Brooks Special thanks to str0ke! Pligg - XSRF Protection Bypass and Captcha Bypass affects 9.9.5 XSRF Protection Bypass ' width="0%" height="0%" var pliggstorytovotefor="/story.php?title=pliggxss";...

Pligg 9.9.5 XSRF Protection Bypass and Captcha Bypass

Exploit for unknown platform in category web applications ===================================================== Pligg 9.9.5 XSRF Protection Bypass and Captcha Bypass ===================================================== Written By Michael Brooks Pligg - XSRF Protection Bypass and Captcha Bypass...

Pligg 9.9.5 XSRF Protection Bypass and Captcha Bypass

No description provided by source. Written By Michael Brooks Special thanks to str0ke! Pligg - XSRF Protection Bypass and Captcha Bypass affects 9.9.5 XSRF Protection Bypass html !-- Remove this iframe from this file and place it on a site that you want to force people to vote for. Change these...

Pligg CMS 9.9.5 - Cross-Site Request Forgery / Protection Bypass / Captcha Bypass

Written By Michael Brooks Special thanks to str0ke! Pligg - XSRF Protection Bypass and Captcha Bypass affects 9.9.5 XSRF Protection Bypass ' width="0%" height="0%" var pliggstorytovotefor="/story.php?title=pliggxss"; function r var Z=false; ifwindow.XMLHttpRequest try Z=new XMLHttpRequest...

CVE-2008-5995

Cross-site scripting XSS vulnerability in the freeCap CAPTCHA srfreecap extension before 1.0.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-5995

CVE-2008-5995 is an XSS vulnerability in the TYPO3 freeCap CAPTCHA (sr_freecap) extension prior to 1.0.4. It allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected documents confirm the vulnerability, but do not provide explicit exploit details or a ...

CVE-2008-5995

Cross-site scripting XSS vulnerability in the freeCap CAPTCHA srfreecap extension before 1.0.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

deV!Lz Clanportal [DZCP] <= 1.4.9.6 Blind SQL Injection Exploit

No description provided by source. use HTTP::Cookies; use LWP::UserAgent; my $ua = LWP::UserAgent-new cookiejar = HTTP::Cookies-new,; $ua-agent 'Mozilla/5.0 Gecko/20061206 Firefox/1.5.0.9' ; usage; print "\n"; $server = $ARGV0; $dir = $ARGV1; $username = $ARGV2; $password = $ARGV3; if !$password...

DZCP (deV!L_z Clanportal) 1.4.9.6 - Blind SQL Injection

DZCP deV!Lz Clanportal 1.4.9.6 - Blind SQL Injection use HTTP::Cookies; use LWP::UserAgent; my $ua = LWP::UserAgent-new cookiejar = HTTP::Cookies-new,; $ua-agent 'Mozilla/5.0 Gecko/20061206 Firefox/1.5.0.9' ; usage; print "\n"; $server = $ARGV0; $dir = $ARGV1; $username = $ARGV2; $password =...

Joomla Component RWCards 3.0.11 Local File Inclusion Vulnerability

No description provided by source. o------------------------------------------------------------------------------------x | Local File Inclusion Vulnerability | o------------------------------------------------------------------------------------o | Software : RWCards 3.0.11 Component for Joomla...

printlog-disclose.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Printlog eNYe-Sec - www.enye-sec.org -- Description by the author's page -- PRITLOG is an extremely simple, small and powerful blog system. It does not use or need a MYSQL database and fully works based on flat files. The idea is derived from a...

TYPO3 Security Bulletin

It has been discovered that the extension freeCap CAPTCHA srfreecap is vulnerable to Cross-Site Scripting. Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.0.3 and all versions below Vulnerability Type: Cross-Site...

default config values restored

This should be for 2.9.1 - this version was not yet available under "affects versions" when filing this bug. After updating from 2.9 to 2.9.1, most of my settings were overwritten by their default values. - public signup got enabled - the language changed back to english instead of german - e-mai...

Spoofing

The CAPTCHA implementation in 1 Pligg 9.9.5 and possibly 2 Francisco Burzi PHP-Nuke 8.1 provides a critical random number the tsrandom value within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value wit...

CVE-2008-3573

The CAPTCHA implementation in 1 Pligg 9.9.5 and possibly 2 Francisco Burzi PHP-Nuke 8.1 provides a critical random number the tsrandom value within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value wit...

CVE-2008-3573

The CAPTCHA implementation in 1 Pligg 9.9.5 and possibly 2 Francisco Burzi PHP-Nuke 8.1 provides a critical random number the tsrandom value within the URL in the SRC attribute of an IMG element, which allows remote attackers to pass the CAPTCHA test via a calculation that combines this value wit...

CVE-2008-3573

The CVE-2008-3573 vulnerability affects the CAPTCHA implementations in Pligg 9.9.5 and possibly PHP-Nuke 8.1. A critical ts_random value is embedded in the IMG SRC URL, allowing remote attackers to pass the CAPTCHA by calculating a value that combines ts_random with the current date and the HTTP ...

Pligg Auto-Voter Using XSS to Bypass CSRF Protection

Explanation: Pligg Suffers from a Reflective Cross Site Scripting vulnerability in index.php. For the $GET'category' variable. Exploit code was written that uses this flaw to bypass the CSRF protection to then vote on any pligg article of the attackers choosing. I took inspiration from the Myspac...

Insufficient Anti-automation vulnerability in RavenNuke

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Insufficient Anti-automation уязвимости в RavenNuke порте PHP-Nuke. Insufficient Anti-Automation: Уязвимость в капче системы. Эксплоит: http://websecurity.com.ua/uploads/2008/RavenNuke20CAPTCHA20bypass.html Уязвима версия RavenNuke 2.20.01 и...