iCart Pro 4.0.1 SQL Injection

Exploit Title: vbcovor ICART SQLI Date: 25/01/2013 Authors: n3tw0rk Contact: Mail:[email protected] Product: iCart Pro Software Version 4.0.1 Product Download: http://www.vbcover.com/icart.php?do=product&productid=61 Google Dork: inurlicart.php Require Editting product access for SQL error...

Veeam ONE: No Collection Data within Monitor, or Collection Stops Updating.

Challenge Data collection stops within Veeam ONE Monitor, or there is no longer any new data from a certain point. Cause This is due to the following database error involving a lack of space in the primary file group for the database .mdf file. Here is a snippet from the Monitor Logs that you wil...

VoiceCMS SQL Injection Vulnerability

Exploit for asp platform in category web applications Title : VoiceCMS Vulnerable to SQL Injection Vendor : http://www.voicecms.ca Found by : p0pc0rn Dork : intext:"Powered by VoiceCMS" SQL - Jet Engine Database Error ------------------------------- Parameter...

PHPWeb enterprise smart built Station system injection and repair-vulnerability warning-the black bar safety net

http://www.phpweb.net/down/class/index.php?myord=1 Directly into the tool can be run. Direct shangguan net: Database error: Invalid SQL: select from pwdowncon where iffb='1' and catid!=' 0' order by 1' desc limit 0,30 MySQL Error : 1 0 6 4 You have an error in your SQL syntax; check the manual...

dedecms injection vulnerability affecting version 5. 3 – 5.5 Posted in php-vulnerability warning-the black bar safety net

Excerpt from: hacking notes dedecms5. 3 and 5. The 5-Series version, there is a major injection vulnerability, Please note the following offensive, only for research. Exploit this vulnerability to illegal activities, at your peril. Suppose domain name is: www. abc. com the attack steps are as...

LxBlog变量未初始化漏洞

Lxblog 是 PHPWind 开发的一套基于 PHP+MySQL 数据库平台架构的多用户博客系统，强调整站与用户个体间的交互，拥有强大的个人主页系统、独立的二级域名体系、灵活的用户模板系统、丰富的朋友圈和相册功能。 代码分析片段： =======================code================================== /user/tag.php ?php !functionexists'usermsg' && exit'Forbidden'; !inarray$type,$itemtype && exit;...

Discuz! 数据库错误信息xss bug

在文件include\dbmysqlerror.inc.php里代码: if$message $errmsg = "bDiscuz! info/b: $message\n\n"; ifisset$GLOBALS'DSESSION''discuzuser' $errmsg .= "bUser/b: ".htmlspecialchars$GLOBALS'DSESSION''discuzuser'."\n"; $errmsg .= "bTime/b: ".gmdate"Y-n-j g:ia", $timestamp + $GLOBALS'timeoffset' 3600."\n"; $errm...

WordPress Plugin Simple Forum 1.10 1.11 - SQL Injection

WordPress Plugin Simple Forum 1.10 1.11 - SQL Injection Simple Forum Version 1.10-1.11 SQL Injection AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAÄ°L : [email protected] Simple Forum - Version 1.10 Simple Forum - Version 1.10 - 2.1.3 Simple Forum - Version 1.11...

CVE-2007-1151

Cross-site scripting XSS vulnerability in LoveCMS 1.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter to the top-level URI, possibly related to a SQL error...

CVE-2007-0347

The iseow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" quote character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service database error via a ' character in certain messages, tickets, or Wiki entries...

CVE-2006-6282

members.php in Vikingboard 0.1.2 allows remote attackers to trigger a forced SQL error via an invalid s parameter, a different vector than CVE-2006-4709. NOTE: might only be an exposure if displayerrors is enabled, but due to lack of details, even this is not clear...

GLSA-200611-11 : TikiWiki: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200611-11 TikiWiki: Multiple vulnerabilities In numerous files TikiWiki provides an empty sortmode parameter, causing TikiWiki to display additional information, including database authentication credentials, in certain error...

CVE-2006-5702: Exposure of Sensitive Information to an Unauthorized Actor

Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information MySQL username and password via an empty sortmode parameter in 1 tiki-listpages.php, 2 tiki-lastchanges.php, 3 messu-archive.php, 4 messu-mailbox.php, 5 messu-sent.php, 6 tiki-directoryaddsite.php, 7 tiki-directoryranking.php,...

DEBIAN-CVE-2005-4744

Off-by-one error in the sqlerror function in sqlunixodbc.c in FreeRADIUS 1.0.2.5-5, and possibly other versions including 1.0.4, might allow remote attackers to cause a denial of service crash and possibly execute arbitrary code by causing the external database query to fail. NOTE: this single...

SQL IN PortailPHP

Class: Input Validation Error CVE: CVE-MAP-NOMATCH Remote: Yes Local: yes Credit: ABDUCTER --- [email protected] OR [email protected] Vulnerable: PortailPHP 2.4 and all version info :- PortailPHP POWERFUL FORUM AND formal site http://www.portailphp.com/ there is sql in index.php...

Update Rollup 1 for System Center Data Protection Manager 2010 (KB2250444)

This hotfix rollup resolves the following issues: You cannot protect the Microsoft Exchange Database Availability Group DAG on a secondary DPM 2010 server. You are prompted to restart a client computer after you install an agent on the client. DPM services crash, and you receive the error, "Unabl...