HauntmAx CMS Haunted House - Directory Listing / SQL Injection

================================== HauntmAx CMS SQLi Vulnerability ================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0...

PHPCMS 2007网站管理系统common.inc.php页面变量覆盖漏洞

PHPCMS是一款基于 PHP+Mysql 架构的网站内容管理系统，也是一个开源的 PHP 开发平台。Phpcms 采用模块化方式开发，功能易用便于扩展，可面向大中型站点提供重量级网站建设解决方案。 在文件incude/common.inc.php中： if!defined'INADMIN' //不是管理员则进入判断 if$CONFIG'dbiscache' $dbfile .= 'cache'; if$CONFIG'phpcache' == '2' $cachefileid = md5$PHPSELF.'?'.$PHPQUERYSTRING; $cachefiledir =...

EMO Realty Manager SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================== EMO Realty Manager SQL Injection Vulnerability ============================================== Author: L0rd CrusAd3r aka VSN email protected Exploit Title:EMO Realty Manager? SQLi Vulnerable...

EMO Realty Manager - SQL Injection

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title:EMO Realty Manager SQLi Vulnerable Published: 2010-06-08 Vendor url:http://emophp.com Price:249$ Platform: Unix, Linux , Windows Greetz to:Sid3^effects, aaNumb, M4n0j and to all ICW members DESCRIPTION: EMO Realty Manager is a full...

TomatoCMS 2.0.6 任意文件上传和跨站脚本漏洞

BUGTRAQ ID: 40544 CVE ID: CVE-2010-1514,CVE-2010-1515 TomatoCMS是一款开源的内容管理系统。 在向TomatoCMS添加新文章时没有对所上传的文件执行重复的验证，拥有Add new article、Upload file to server和Browse uploaded files权限的用户可以向服务器上传并执行恶意文件。 TomatoCMS没有正确地过滤提交给index.php/admin/news/article/list页面的keyword和article-...

Symphony Detection

Symphony, an XSLT-powered, open source content management system, is hosted on the remote web server. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid46818; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...

phpcms2008 sp4 网站内容管理系统多处跨站漏洞

Phpcms 是国内领先的网站内容管理系统，同时也是一个开源的PHP开发框架。Phpcms由内容模型、会员、问吧、专题、财务、订单、广告、邮件订阅、 短消息、自定义表单、全站搜索等20多个功能模块组成，内置新闻、图片、下载、信息、产品5大内容模型。Phpcms 采用模块化开发，支持自定义内容模型和会员模型，并且可以自定义字段。 对用户输入处理不严，存在多处跨站漏洞 phpcms2008 sp4 厂商补丁： PHPCMS ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpcms.cn/...

phpcms2008 sp4 /member/login.php cross-site vulnerabilities-vulnerability warning-the black bar safety net

Phpcms is a leading web content management system, but also is an open-source PHP development framework. Phpcms by the content model, Membership, ask, theme, financial, orders, advertising, email subscription, short Messaging, custom forms, site wide search, etc. the 2 0 plurality of functional...

phpcms2008 sp4 网站内容管理系统搜索模块跨站漏洞

Phpcms 是国内领先的网站内容管理系统，同时也是一个开源的PHP开发框架。Phpcms由内容模型、会员、问吧、专题、财务、订单、广告、邮件订阅、 短消息、自定义表单、全站搜索等20多个功能模块组成，内置新闻、图片、下载、信息、产品5大内容模型。Phpcms 采用模块化开发，支持自定义内容模型和会员模型，并且可以自定义字段。 搜索没有进行有效的处理，造成跨站漏洞 phpcms2008 sp4 厂商补丁： PHPCMS ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpcms.cn/...

Webiz 2004 - Local File Upload

Exploit Title: Webiz local SHELL Upload Vulnerability Date: 23-05-2010 Author: kannibal615 Software Link: N/A Version: 2004 Tested on: PHP CVE : N/A Code : @@ @@ @@@@@@ @@ @@ @@@@ @@@@@@@ @@ @@ @@@@@@@ @@@@@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@ @@@ @@@@@@@@ @@ @@ @@ @@@@ @@@@@@ @@ @...

TikiWiki Detection

The remote web server hosts TikiWiki aka Tiki, a PHP-based content management software used to build and maintain websites. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid46736; scriptversion"1.10"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2010-2013

Cross-site scripting XSS vulnerability in cp/editemail.php in LiSK CMS 4.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2010-2017

Cross-site scripting XSS vulnerability in hasil-pencarian.html in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to inject arbitrary web script or HTML via the kata parameter. NOTE: some of these details are obtained from third party information...

CVE-2010-2019

SQL injection vulnerability in downlot.php in Lokomedia CMS 1.4.1, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the file parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2010-2018

Directory traversal vulnerability in downlot.php in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

e107 content management system usersettings. php page there is SQL injection vulnerability-vulnerability warning-the black bar safety net

e107 is a php written content management system. e107 of the usersettings. php page existsSQL injectionvulnerabilities: if $ret == ’ $loginname = striptags$POST’loginname’; if !$ loginname $loginname = $udata’userloginname’; else if! checkclass$pref’displaynameclass’, $udata’userclasslist’, $peer...

Entry Level Content Management System (EL CMS) - SQL Injection

Entry Level Content Management System EL CMS - SQL Injection + Contact : vir0e5athackermaildotcom + Group : TECON The Eye COnference Indonesia + Site : http://tecon-crew.org Software Information +SOftware : Entry Level Content Management System EL CMS +vendor : http://www.entrylevelcms.com/...

CMSQLite <= 1.2 c参数SQL注入漏洞

CMSQLite是基于PHP和SQLite的内容管理系统。 CMSQlite的index.php页面存在SQL注入漏洞： ifisset$GET'c' $contentId=$GET'c'; else if $seourl $arrArticleInfo = $SYSTEM-resolveURL$SERVER'REQUESTURI', $langId; ifempty$arrArticleInfo $contentId=1; else $contentId = $arrArticleInfo0'articleId'; $module = $arrArticleInfo0'module';...

e107 0.7.20 Usersettings页面SQL注入漏洞

e107是用php编写的内容管理系统。 e107的usersettings.php页面存在SQL注入漏洞： if $ret == '' $loginname = striptags$POST'loginname'; if !$loginname $loginname = $udata'userloginname'; else if!checkclass$pref'displaynameclass', $udata'userclasslist', $peer $newusername = "username = '$loginname', "; $username = $loginname...

The iceberg - 'Content Management System' SQL Injection

========================================================== The iceberg 'Content Management System' SQL Injection Vulnerability ========================================================== The iceberg 'Content Management System' SQL Injection Vulnerability Homepage : http://www.imagetraders.com.au...