CVE-2007-0096

The CVE-2007-0096 issue affects CarbonCommunities, where sensitive data is stored under the web root with inadequate access control. This allows remote attackers to download a database (DataBase/Carbon2.4d.mdb) via a direct request. The available sources describe the vulnerability in terms of imp...

About the database the simple intrusion and rogue damage-vulnerability warning-the black bar safety net

For domestic and foreign a lot of news, BBS and e-Commerce site using ASP+SQL design, and write an ASP programmer many many have just graduated, so, ASP+SQL attack success rate is relatively high. This type of attack method with the NT version and SQL version is not much relationship, there is no...

CVE-2006-6617

CVE-2006-6617 affects Microsoft Project Server 2003. The vulnerability lies in projectserver/logon/pdsrequest.asp where a GetInitializationData response can expose the UserName and Password fields, allowing remote authenticated users to obtain the MSProjectUser password for the SQL database. The ...

listpics.txt

Title: listpics v5 Author: BLaSTER Contact: [email protected] Script: http://www.aspindir.com/indir.asp?id=2866 //Database Hacked.. http://target/path/Database/.mdb Example: http://victim.com/KhaledMuratList/Database/listpics.mdb // Greetz : BLaCKWHITE, Satanist-imam, EaGLe, FreeZe, LGMAN and...

Evolve Shopping Cart - products.asp SQL Injection

Evolve Shopping Cart - products.asp SQL Injection source: https://www.securityfocus.com/bid/21323/info Evolve Shopping Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could...

Oracle <= 9i / 10g (read/write/execute) Exploitation Suite

No description provided by source. -- -- $Id: raptororaexec.sql,v 1.2 2006/11/23 23:40:16 raptor Exp $ -- -- raptororaexec.sql - java exploitation suite for oracle -- Copyright c 2006 Marco Ivaldi [email protected] -- -- This is an exploitation suite for Oracle written in Java. Use it to --...

Fixit iDms Pro Image Gallery - filelist.asp Multiple SQL Injections

Fixit iDms Pro Image Gallery - filelist.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/21282/info Fixit iDMS Pro is prone to multiple input-validation vulnerabilities, including SQL-injection issues and an HTML-injection issue, because the application fails to properly...

vSpin Classified System 2004 - 'cat.asp?catname' Cross-Site Scripting

source: https://www.securityfocus.com/bid/21190/info vSpin Classified System is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied data. Exploiting these issues could all...

Grandora Rialto 1.6 - listfull.asp?ID SQL Injection

Grandora Rialto 1.6 - listfull.asp?ID SQL Injection source: https://www.securityfocus.com/bid/21191/info Grandora Rialto is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data...

Grandora Rialto 1.6 - 'printmain.asp?ID' SQL Injection

source: https://www.securityfocus.com/bid/21191/info Grandora Rialto is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to steal...

Enthrallweb eClassifieds - ad.asp Multiple SQL Injections

Enthrallweb eClassifieds - ad.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/21192/info eClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues coul...

Enthrallweb eHomes - result.asp Multiple SQL Injections

Enthrallweb eHomes - result.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/21193/info eHome is prone to multiple input-validation vulnerabilities, including cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied inpu...

BestWebApp Dating Site Login Component - Multiple Field SQL Injections

source: https://www.securityfocus.com/bid/21158/info BestWebApp Dating Site is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input. An attacker could exploit these issues to stea...

MGinternet Property Site Manager - admin_login.asp Multiple SQL Injections

MGinternet Property Site Manager - adminlogin.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/21073/info MGinternet Property Site Manager is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to...

Car Site Manager - csmasplistings.asp Multiple SQL Injections

Car Site Manager - csmasplistings.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/21066/info Car Site Manager is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues cou...

INFINICART - 'browse_group.asp?groupid' SQL Injection

source: https://www.securityfocus.com/bid/21043/info Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input. A successful exploit of these vulnerabilities could all...

Oracle Spatial component SDO_CS.TRANSFORM_LAYER buffer overflow

Added: 10/26/2006 CVE: CVE-2006-5344 BID: 20588 OSVDB: 31462 Background The Oracle Spatial formerly SDO component of Oracle Database provides a set of functions which process multi-dimensional data. Problem A buffer overflow in the Oracle Spatial component allows an attacker with EXECUTE privileg...

SQL Injection in package SYS.DBMS_CDC_IMPDP

Name SQL Injection in package SYS.DBMSCDCIMPDP DB04 Systems Affected Oracle 10g Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 October 2006 V 1.00 Advisory...

Oracle Spatial component SDO_CS.TRANSFORM_LAYER buffer overflow

Added: 10/26/2006 CVE: CVE-2006-5344 BID: 20588 OSVDB: 31462 Background The Oracle Spatial formerly SDO component of Oracle Database provides a set of functions which process multi-dimensional data. Problem A buffer overflow in the Oracle Spatial component allows an attacker with EXECUTE privileg...

Invision Gallery <= 2.0.7 ReadFile() & SQL Injection Exploit (linux)

Exploit for unknown platform in category web applications ==================================================================== Invision Gallery 2.0.7 ReadFile & SQL injection exploit +-------------+ | Uzage: | +-------------+ + ReadFile: - syntax: readfile 1 readfile 2 // try it if readfile1 fail...