SQL injection in Bigware shop software

The Bigware shop software prior to version 2.15 contains a SQL injection, resulting in full database compromise. The injection point is the POST parameter 'lastname' in the module mainbigware43.php. A user must be created before exploitation. Proof of concept is at...

Alstrasoft EPay Enterprise 4.0 - Blind SQL Injection

Alstrasoft EPay Enterprise 4.0 - Blind SQL Injection Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0...

AlstraSoft EPay Enterprise v4.0 Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0...

Alstrasoft EPay Enterprise 4.0 - Blind SQL Injection

Exploit Title: AlstraSoft EPay Enterprise v4.0 Blind SQL Injection Google Dork: Copyright @ 2010 iPayGold.com Date: Decembar/6/2011 Author: Don BalcanCrew & BalcanHack Software Link: http://www.alstrasoft.com/epayenterprise.htm Version: 4.0 Tested on: Apache/1.3.37 An attacker may execute arbitra...

WineHQ database compromise - One More Linux Project Fail

WineHQ database compromise - One More Linux Project Fail Jeremy White, Codeweavers Founder has announced that access to the WineHQ database has been compromised. "On the one hand, we saw no evidence of harm to any database. We saw no evidence of any attempt to change the database and candidly,...

WineHQ database compromise - One More Linux Project Fail

WineHQ database compromise - One More Linux Project Fail Jeremy White, Codeweavers Founder has announced that access to the WineHQ database has been compromised. "On the one hand, we saw no evidence of harm to any database. We saw no evidence of any attempt to change the database and candidly,...

eFront Enterprise Edition 3.6.9 SQL Injection

Title: ====== eFront Enterprise Edition v3.6.9 - SQL Injection Vulnerability Date: ===== 2011-10-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=230 VL-ID: ===== 230 Introduction: ============= Tailored with larger organizations in mind, eFront Enterprise offers...

Symantec IM Manager Administrator Console Multiple Issues

SUMMARY Symantec IM Manager is vulnerable to Code Injection, Cross-Site Scripting and SQL Injection. Successful exploitation of these vulnerabilities could result in injection/execution of arbitrary code in the context of the browser or the application. AFFECTED PRODUCTS Product | Version |...

La Poste FR Website - Multiple SQL Injection Vulnerabilities

Document Title: =============== La Poste FR Website - Multiple SQL Injection Vulnerabilities Release Date: ============= 2011-09-12 Vulnerability Laboratory ID VL-ID: ==================================== 267 Product & Service Introduction: =============================== La Poste is the mail...

Free Help Desk 1.1b - Multiple Input Validation Vulnerabilities

Free Help Desk 1.1b - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/49721/info Free Help Desk is prone to the following input-validation vulnerabilities: 1. A cross-site scripting vulnerability 2. Multiple SQL-injection vulnerabilities 3. A cross-site...

Free Help Desk 1.1b - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/49721/info Free Help Desk is prone to the following input-validation vulnerabilities: 1. A cross-site scripting vulnerability 2. Multiple SQL-injection vulnerabilities 3. A cross-site request-forgery vulnerability Exploiting these issues could allow an...

TRUSTe Website - Remote SQL Injection Vulnerability

Document Title: =============== TRUSTe Website - Remote SQL Injection Vulnerability Release Date: ============= 2011-07-18 Vulnerability Laboratory ID VL-ID: ==================================== 188 Product & Service Introduction: =============================== TRUSTe is a company based in San...

HTB22897: SQL injection vulnerability in Ripe website manager

Vulnerability ID: HTB22897 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityinripewebsitemanager.html Product: Ripe website manager Vendor: Ripe website manager Team http://www.ripewebsitemanager.com/ Vulnerable Version: 1.1 and probably prior versions Vendor Notification: 10...

Esselbach Storyteller CMS System 1.8 - SQL Injection

Exploit Title: Esselbach Storyteller CMS System Version 1.8 page.php Remote SQL Injection Vulnerability Date: March, 9th 2011 GMT +7 Author: Shamus Software Link: http://www.esselbach.com/ Version : Esselbach Storyteller CMS System Version 1.8 Tested on: windows CVE : -...

Phenotype CMS 3.0 SQL Injection

Vulnerability ID: HTB22769 Reference: http://www.htbridge.ch/advisory/sqlinjectioninphenotypecms.html Product: Phenotype CMS Vendor: http://www.phenotype-cms.com http://www.phenotype-cms.com Vulnerable Version: 3.0 Vendor Notification: 21 December 2010 Vulnerability Type: SQL Injection Status: No...

KLINK SQL Injection Vulnerability

Exploit for php platform in category web applications Dork : "allinurl:.php?txtCodiInfo=" An attacker may execute arbitrary SQL statements on the vulnerable system. This may compromise the integrity of your database and/or expose sensitive information. Example 1:...

Hycus CMS 1.0.3 SQL Injection

Vulnerability ID: HTB22738 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL injection Status: Not Fixed, Vendor...

SQL injection in Hycus CMS

Vulnerability ID: HTB22741 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms3.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL Injection Status: Not Fixed, Vendo...

SQL injection in Hycus CMS

Vulnerability ID: HTB22738 Reference: http://www.htbridge.ch/advisory/sqlinjectioninhycuscms.html Product: Hycus CMS Vendor: Hycus Web Development Team http://www.hycus.com/ Vulnerable Version: 1.0.3 Vendor Notification: 07 December 2010 Vulnerability Type: SQL injection Status: Not Fixed, Vendor...

SQL Injection in Elxis CMS

Vulnerability ID: HTB22700 Reference: http://www.htbridge.ch/advisory/sqlinjectioninelxiscms1.html Product: Elxis CMS Vendor: Elxis Team http://www.elxis.org/ Vulnerable Version: 2009.2 electra Vendor Notification: 16 November 2010 Vulnerability Type: SQL Injection Status: Fixed by Vendor Risk...