CubeCart 3.0.x - view_order.php?order_id Cross-Site Scripting

CubeCart 3.0.x - vieworder.php?orderid Cross-Site Scripting source: https://www.securityfocus.com/bid/20215/info CubeCart is prone to multiple input-validation vulnerabilities, including information-disclosure, cross-site scripting, and SQL-injection issues, because the application fails to...

MyReview Admin.php email Parameter SQL Injection

The remote host is running MyReview, an open source paper submission and review web application. The version of MyReview installed on the remote host fails to properly sanitize input to the 'email' parameter before using it in the 'GetMember' function in a database query. Regardless of PHP's...

DCP-Portal 6.0 - adminincfooter.inc.php Multiple Cross-Site Scripting Vulnerabilities

DCP-Portal 6.0 - adminincfooter.inc.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/20024/info DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues,...

Opsware NAS 6.0 reveals MySQL 'root' password

The Opsware Network Automation System NAS version 6.0 installation places an 'init' style startup script in /etc/init.d/mysqll and places the 'root' password that you choose for the MySQL MAX database during installation. The permissions on this small shell script are world readable, allowing any...

Oracle Database - SQL Injection in SYS.KUPW$WORKER [DB03]

Name SQL Injection in package SYS.KUPW$WORKER 6980775 DB03 Systems Oracle 10g Release 1 Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 Jul 2006 V 1.00 Advisory...

Oracle Database - SQL Injection in SYS.DBMS_CDC_IMPDP [DB01]

Name SQL Injection in package SYS.DBMSCDCIMPDP 6980711 DB01 Systems Oracle 10g Release 1 Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 Jul 2006 V 1.00 Details The package SYS.DBMSCDCIMPDP contains...

Oracle Database - SQL Injection in SYS.DBMS_STATS [DB21]

Name SQL Injection in package SYS.DBMSSTATS 6980751 DB21 Systems Oracle 10g Release 1 Severity High Risk Category SQL Injection Vendor URL http://www.oracle.com/ Author Alexander Kornbrust ak at red-database-security.com Advisory 18 Jul 2006 V 1.00 Advisory...

CVE-2003-1304

Affected software: EarlyImpact ProductCart 1.0–2.0. Vulnerability: storing database/EIPC.mdb under the web root with insufficient access control, enabling remote retrieval of sensitive data via direct requests. Impact: exposure of database contents; specifics on exploitability/real-world exploita...

CVE-2006-3487

Summary: CVE-2006-3487 affects VirtuaStore 2.0, where sensitive files are stored under the web root with insufficient access control. This allows remote attackers to obtain local database information by directly accessing the path database/virtuastore.mdb. Impact (as stated): Disclosure of local ...

LifeType 1.0.5 - index.php?Date SQL Injection

LifeType 1.0.5 - index.php?Date SQL Injection source: https://www.securityfocus.com/bid/18835/info LifeType is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit...

Diesel Joke Site - 'Category.php' SQL Injection

source: https://www.securityfocus.com/bid/18760/info Diesel Joke Site is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise t...

Crack*. mdb currently all versions of the password-vulnerability warning-the black bar safety net

On the Access97 password hack, in a lot of sites and magazines have been introduced. Here I simply repeat it. In the mdb file the 0x42 Byte 1-3 byte, respectively, with 0x86,0xfb,0xec,0x37,0x5d,0x44,0x9c,0xfa,0xc6,0x5e,0x28,0xe6,0x13 XOR can be obtained after the database password. But in Access ...

vCard PRO - 'search.php?event_id' SQL Injection

source: https://www.securityfocus.com/bid/18699/info VCard PRO is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromi...

Re[2]: The Weakness of Windows Impersonation Model

Just one important note regarding Database Security Brief: http://www.databasesecurity.com/dbsec/db-sec-tokens.pdf "Why should I never logon to a Windows database server if I've got admin privileges?" We describe a little different problem for MS SQL. MS SQL gets privileged context on its own fro...

Re: The Weakness of Windows Impersonation Model

Hi Brian, I wrote a paper on this subject last year, "Snagging Security Tokens to Elevate Privileges" http://www.databasesecurity.com/dbsec-briefs.htm after Tim Mullen and thrashed out a few details at Blackhat last year over a few White Russians. The paper discusses the problem in the context of...

EImagePro - subList.asp?CatID SQL Injection

EImagePro - subList.asp?CatID SQL Injection source: https://www.securityfocus.com/bid/17911/info EImagePro is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...

EImagePro - 'subList.asp?CatID' SQL Injection

source: https://www.securityfocus.com/bid/17911/info EImagePro is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploits could allow an attacker to compromis...

ISP Site Man - 'admin_login.asp' SQL Injection

source: https://www.securityfocus.com/bid/17347/info Site Man is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

SoftBiz Image Gallery - images.php?cid SQL Injection

SoftBiz Image Gallery - images.php?cid SQL Injection source: https://www.securityfocus.com/bid/17339/info Softbiz Image Gallery is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an S...

Maian Weblog 2.0 - 'print.php' SQL Injection

source: https://www.securityfocus.com/bid/17247/info Maian Weblog is prone to multiple SQL-injection vulnerabilities. The application fails to properly sanitize user-supplied input before using it in SQL queries. This will allow an attacker to inject arbitrary SQL logic into the vulnerable...