Sqlninja Automated SQL Injection tool

Sqlninja is an automated SQL Injection tool. Remote attackers can use Sqlninja to fetch data from the database and execute SQL statements...

Researcher Warns of Critical Flaws in Oracle Servers

There are two vulnerabilities in some of Oracle’s older database packages that allow an attacker to access a remote server without a password and even view the server’s filesystem and dump arbitrary files. Oracle has not released a patch for one of the flaws, even though it was reported by a...

Encrypt password variables

All variables are currently stored in the database with no encryption Exceptions are repository passwords and Bamboo passwords which are irreversibly hashed/salted. ex. : Deployment variables that contain passwords are stored in the database with no encryption. So anyone with access to the databa...

Command School Student Management System - '/sw/admin_subjects.php?id' SQL Injection

source: https://www.securityfocus.com/bid/64707/info Command School Student Management System is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. A cross-site request forgery vulnerability 3. A cross-site scripting vulnerability 4. An HTML injection...

shop7z购物系统可插一句话

简要描述： 数据库默认为asp后缀，提供了插一句话的前提，用错误代码方式防止数据库下载，但是可以注释掉错误代码 详细说明： 记事本打开数据库看了下这串代码的大概位置，然后就开始找地方插一句话。 注册一个帐号， 注册信息时随便找个地方填入 ┳ 原型为 3% 然后再到留言处留言，标题填写 ┼攠數畣整爠煥敵瑳∨∣┩愾┼砧 原型为 a 漏洞证明： 测试官网当前版本...

Netin(Knight)content management system vulnerability-vulnerability warning-the black bar safety net

A very cold content management system, for the first time. Background path: netin/Login. asp Default user: admin/netin The default password is:0 0 0 0 0 0/netin2009 Default database:db$snetinb\db$snetin. mdb The default administrator table: BsUser Injection point: http://0day5.com/shownews.asp?id...

Zend-Framework - Full Information Disclosure

Zend-Framework - Full Information Disclosure Exploit Title : Zend-Framework Full Info Disclosure Google Dork : inurl:/application/configs/application.ini Date : 26/11/2013 Exploit Author : Ariel Orellana Vendor Homepage : http://framework.zend.com/ Category : Web applications Tested on : GNU/Linu...

SAP Sybase Adaptive Server Enterprise Information Disclosure (SAP Note 1893562)

Information about SAP Sybase ASE may be discovered in database dump files. This information may be used by an attacker to create targeted attacks against SAP Sybase ASE. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid70980; scriptversion"1.9";...

Microweber 0.905 SQL Injection

=============================================================================== | | / / / / / / // / / -/ - / // / / / / // / ////,//////,// ///, / // team PUBLIC SECURITY ADVISORY | | =============================================================================== TITLE ===== Microweber...

CVE-2013-3279

EMC Atmos before 2.1.4 uses a default/blank PostgreSQL password, allowing remote attackers to connect to the database server and obtain sensitive administrative information. Affected: Atmos software on all supported hardware/VE prior to 2.1.4. Root cause: unauthenticated access due to no password...

CVE-2013-5208

CVE-2013-5208 affects HR Systems Strategies info:HR HRIS 7.9, where the database password is stored in a registry key (USERPW) with weak obfuscation. This enables a local attacker to read/decipher the password and gain full control of the database and application, including access to PII. Vendor ...

mod_accounting Module 0.5 - Blind SQL Injection

modaccounting Module 0.5 - Blind SQL Injection - Affected Vendor: http://sourceforge.net/projects/mod-acct/files/ - Affected Software: modaccounting - Affected Version: 0.5. Other earlier versions may be affected. - Issue type: Blind SQL injection - Release Date: 20 Sep 2013 - Discovered by: Elda...

Woltlab Burning Board FLVideo Addon SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Woltlab Burning Board FLVideo Addon SQL Injection flvideo.php Exploit Google Dork: inurl:flvideo.php wbb and more Date: 04.09.2013 Exploit Author: Easy Laster Vendor Homepage: http://www.flvideo.de/ Version: FLVideo Addon for WB...

v5shop官方数据库存在弱口令可获取库内全部数据

简要描述： 首先说明！从头到尾没有拿过shell！我也没有shell 今天上乌云看看有啥漏洞，结过看到20天没审核的V5shop审核了，还给了好多rank。 就看了看，骗rank啦，，，v5shop也不是小厂商的说。 详细说明： 好吧，手贱看看目录吧！ dedecms的好像，，，没别的漏洞！ 看看/phpMyAdmin/ 尼玛！猜中了。。。 http://www.v5shop.com.cn/phpMyAdmin/ 好吧，用v5shop，v5shop试试，（麻烦审核后打码哦！） 好鸟。。。。 看看自评20rank会给多少啊! 漏洞证明： 上图，不说了！ 自己test去吧。。...

CVE-2013-0148

The CVE-2013-0148 issue affects FairCom c-treeACE’s Data Camouflage (formerly FairCom Standard Encryption). The vulnerability is that the decryption key is not required to access database contents, allowing an attacker to read cleartext records by copying a database to another system configured w...

PHP Address Book - addressbookregisterdelete_user.php?id SQL Injection

PHP Address Book - addressbookregisterdeleteuser.php?id SQL Injection source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker ...

PHP Address Book - '/addressbook/register/edit_user.php?id' SQL Injection

source: https://www.securityfocus.com/bid/58911/info PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit laten...

Getting Your Databases Audit Ready

Your database is perhaps one of the most sensitive targets for cybercriminals as they are your companys primary repository for confidential and proprietary data. Besides knowing what vulnerabilities exist for your perimeter network and also for your internal systems, best practices require you to...

Sparx Systems Enterprise Architect 9.3.931 Corporate Password Disclosure

Subject ======= Simple password obfuscation in Sparx Systems "Enterprise Architect" when using server based repositories Affected product ================ Product: Enterprise Architect Vendor: Sparx Systems Affected versions ================= Tested with 9.3.931 Corporate, other versions likely t...

SAP NetWeaver ABAD0_DELETE_DERIVATION_TABLE - SQL Injection

Application: SAP NetWeaver Versions Affected: 7.30 Basis 720 SP 0, Kernel 720 patch 68 Vendor URL: http://www.sap.com Bugs: SQL injection Exploits: NO Reported: 25.01.2013 Vendor response: 26.01.2013 Date of Public Advisory: 30.08.2013 Reference: SAP Security Note 1840249 Author: Nikolay Mescheri...