CVE-2008-6872

Affected software: ASPThai.NET ASPThai Forums 8.5. The vulnerability is improper access control that lets an attacker access the webroot-stored database file database/aspthaiForum.mdb via a direct request, exposing sensitive data. This is the underlying cause: insecure storage and access control ...

CVE-2009-1322

ASP Product Catalog 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for database/aspProductCatalog.mdb...

CVE-2003-1571

CVE-2003-1571 affects Web Wiz Guestbook 6.0 (and later 8.21 per note) where sensitive data is stored under the web root with insufficient access control, allowing remote attackers to download the database via a direct request to database/WWGguestbook.mdb. The underlying issue is inadequate access...

Improper access control

Easy Content Management Publishing stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Database/News.mdb...

cf shopkart 5.2.2 - SQL Injection / File Disclosure

-------------------------------AlpHaNiX---------------------------------- Found By : AlpHaNiX website : www.offensivetrack.org contact : AlpHaATHACKERDOTBZ script : CF SHOPKART V5.2.2 download : http://www.cfshopkart.com/dl/cfshopkart522.rar Demo : http://www.cfshopkart.com/demos/cfshopkart522/...

humo-sql.txt

Title: humo.be SQL Injection vuln Description: The site www.humo.be a Belgian magazine has a page where people can vote on various things. This page, however, has an SQL Injection vulnerability. Author: Tosser E-mail: [email protected] Proof:...

MyWeb SQL injection vulnerability

Overview Groupware MyWeb contains a SQL injection vulnerability. Impact A remote attacker could view or modify the database contents. Solution None...

The rookie caught the chicken collection－mining chicken application-vulnerability warning-the black bar safety net

Keywords :enterprise post office, enterprise honour marketing network products categories feedback contact us bookmark this site Drop out: /db/com02. mdb Upload page:/upfilephoto. asp The default password is: admin/login. asp Keywords :flying over the company enterprise web site management system...

PHPizabi v0.848b C1 HFP3 Database Information Disclosure Vuln

Exploit for unknown platform in category web applications ============================================================= PHPizabi v0.848b C1 HFP3 Database Information Disclosure Vuln =============================================================...

flinx <= 1.3 (category.php id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================= flinx Exploit : Target.il/flinxpath/category.php?id=SQL-CODE tables and columns names = table : flinxcat columns : name / catid = table : flinxlink columns : name / url /...

WebWizForum暴露数据库漏洞

Web Wiz Forum是一款简单的论坛系统，使用ASP编写。支持access/mssql数据库.Web Wiz Forum存在暴露数据库漏洞可导致利用者通过%5c暴出论坛数据库的绝对路径及数据库名，从而导致数据库被下载危急论坛安全。 WebWizForum 7.01-7.7 升级程序 ：WebWizForum 7.8以上http://www.webwizforums.com/关闭服务器错误显示 http://www.example.com/bbs%5cforumtopics.asp?FID=%201...

CVE-2006-3780

CVE-2006-3780 affects Keyifweb Keyif Portal 2.0. The issue is insufficient access control that allows remote attackers to download sensitive database files exposed under the web root, via direct requests to (1) ANKET/anket.mdb, (2) HABER/keyifweb.mdb, (3) ASP/download.mdb, or (4) SAYAC/aktif.mdb ...

CVE-2006-3487

VirtuaStore 2.0 stores sensitive files under the web root with insufficient access control, which allows remote attackers to obtain local database information by directly accessing database/virtuastore.mdb...

xueBookSQL.txt

------------------------------------------------------ Nightmare TeAmZ Advisory 003 ------------------------------------------------------ Date - 11/2005 xueBook 1.0 Sql Injection AFFECTED PRODUCTS ================= xueBook 1.0 Guestbook...

PHPNews news.php prevnext Parameter SQL Injection

The remote host is running PHPNews, an open source news application written in PHP. The installed version of PHPNews is prone to a SQL injection attack due to its failure to sanitize user-supplied input via the 'prevnext' parameter of the 'news.php' script. An attacker can exploit this flaw to...

CVE-2004-2060

ASPRunner 2.4 stores the database under the web root in the db directory, which may allow remote attackers to obtain the database via a direct request to the database filename, which is predictable based on table and field names...

UblogXSS.txt

PersianHacker.NET 200503-11Ublog reload 1.0.4 and prior Multiple Vulnerbilities Date: 2005 03 Bug Number: 11 Ublog Ublog reload is a complete ASP weblog system. More info @: http://www.uapplication.com Discussion: -------------------- What are the bugs ? 1 Cross-Site Scripting that lets attackers...

[PersianHacker.NET 200503-11]Ublog reload 1.0.4 and prior Multiple Vulnerbilities

PersianHacker.NET 200503-11Ublog reload 1.0.4 and prior Multiple Vulnerbilities Date: 2005 03 Bug Number: 11 Ublog Ublog reload is a complete ASP weblog system. More info @: http://www.uapplication.com Discussion: -------------------- What are the bugs ? 1 Cross-Site Scripting that lets attackers...

EUVD-2005-0854

betaparticle blog bp blog stores the database under the web root, which allows remote attackers to obtain sensitive information via a direct request to 1 dbBlogMX.mdb for versions before 3.0, or 2 Blog.mdb for versions 3.0 and later. NOTE: it was later reported that vector 2 also affects versions...

Kayako eSupport 2.x - Ticket System Multiple SQL Injections

Kayako eSupport 2.x - Ticket System Multiple SQL Injections source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten compromise...