Real Estate Classifieds 'index.php' SQL注入漏洞

BUGTRAQ ID: 31723 CNCAN ID：CNCAN-2008101408 Real Estate Classifieds是一款基于PHP的WEB应用程序。 Real Estate Classifieds不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'index.php'脚本对用户提交给'cat'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Real Estate Scripts Real Estate Classifieds 目前没有解决方案提供：...

res-sql.txt

Author : EgY Coders TM Home : Www.educ-up.com Type Gap : SQL INJECTION script : Real-Estate-Scripts see script http://www.real-estate-scripts.com/demo.html Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQLinj4ct0r , Stealth , Kof2002 ,Bright D@rk + Bug in : index.php POC...

Real Estate Scripts 2008 (index.php cat) SQL Injection Vulnerability

No description provided by source. Author : EgY Coders TM Hakxer Home : Www.educ-up.com Type Gap : SQL INJECTION script : Real-Estate-Scripts see script http://www.real-estate-scripts.com/demo.html Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQLinj4ct0r , Stealth , Kof2002 ,Bright...

Real Estate Scripts 2008 - cat SQL Injection

Real Estate Scripts 2008 - cat SQL Injection Author : EgY Coders TM Home : Www.educ-up.com Type Gap : SQL INJECTION script : Real-Estate-Scripts see script http://www.real-estate-scripts.com/demo.html Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQLinj4ct0r , Stealth , Kof2002 ,Brig...

Real Estate Scripts 2008 (index.php cat) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Real Estate Scripts 2008 index.php cat SQL Injection Vulnerability ==================================================================== Author : EgY Coders TM Type Gap :...

Real Estate Scripts 2008 - 'cat' SQL Injection

Author : EgY Coders TM Home : Www.educ-up.com Type Gap : SQL INJECTION script : Real-Estate-Scripts see script http://www.real-estate-scripts.com/demo.html Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQLinj4ct0r , Stealth , Kof2002 ,Bright D@rk + Bug in : index.php POC...

CVE-2008-4497

SQL injection vulnerability in eventdetail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute arbitrary SQL commands via the eventid parameter...

Sql injection

SQL injection vulnerability in eventdetail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute arbitrary SQL commands via the eventid parameter...

CVE-2008-4497

SQL injection vulnerability in eventdetail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute arbitrary SQL commands via the eventid parameter...

CVE-2008-4497

CVE-2008-4497 is an SQL injection vulnerability in Built2Go Real Estate Listings 1.5, exploitable via the event_id parameter of event_detail.php. Remote attackers can potentially execute arbitrary SQL commands. The NVD entry records a base score of 7.5 (HIGH) with network attack vector and low co...

built2go-sql.txt

----------------------------------------------------------------------------- Built2Go PHP RealEstate v1.5 eventdetail.php - SQL Injection Vulnerability A professional real estate listings website. Lists homes for sale and apartments for rent, and provides a powerful search similar to the...

CVE-2008-4497: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in eventdetail.php in Built2Go Real Estate Listings 1.5 allows remote attackers to execute arbitrary SQL commands via the eventid parameter...

Built2Go PHP Realestate 1.5 - event_detail.php SQL Injection

Built2Go PHP Realestate 1.5 - eventdetail.php SQL Injection ----------------------------------------------------------------------------- Built2Go PHP RealEstate v1.5 eventdetail.php - SQL Injection Vulnerability A professional real estate listings website. Lists homes for sale and apartments for...

Unfixed XSS vulnerability at www.blacktownrealestate.com.au

Security researcher C1c4Tr1Z, has submitted on 10/03/2008 a cross-site-scripting XSS vulnerability affecting www.blacktownrealestate.com.au, which at the time of submission ranked 11738323 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on...

sgrealestate-cookie.txt

SG Real Estate Portal 2.0 Insecure Cookie Handling Vulnerability + Discovered By Stack + Greetz : All my freind Exploit: javascript:document.cookie = "Auth=1; path=/;";...

sgrealestate-sqllfi.txt

SG Real Estate Portal 2.0 Blind SQL Injection/Local File Inclusion + Discovered By SirGod + MorTal TeaM + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke script: http://serverfree.org/download.php?file=347076 + Local File Inclusion - Note : For PoC's 4,5 you...

SG Real Estate Portal 2.0 Insecure Cookie Handling Vulnerability

No description provided by source. + SG Real Estate Portal 2.0 Insecure Cookie Handling Vulnerability + Discovered By Stack + Greetz : All my freind Exploit: javascript:document.cookie = "Auth=1; path=/;";...

SG Real Estate Portal 2.0 Blind SQL Injection Exploit

No description provided by source. ?php iniset"maxexecutiontime",0; printr' SG Real Estate Portal 2.0 - Blind SQL Injection Exploit Vulnerability discovered by: Stack Exploit coded by: Stack Greetz to: All My Freind Admin Panel: Target/SG/ Usage: php '.$argv0.' Target Userid Example : php...

SG Real Estate Portal 2.0 Blind SQL Injection/Local File Inclusion Vulns

No description provided by source. + SG Real Estate Portal 2.0 Blind SQL Injection/Local File Inclusion + Discovered By SirGod + MorTal TeaM + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke script: http://serverfree.org/download.php?file=347076 + Local File...

SG Real Estate Portal 2.0 Insecure Cookie Handling Vulnerability

Exploit for unknown platform in category web applications ================================================================ SG Real Estate Portal 2.0 Insecure Cookie Handling Vulnerability ================================================================ + SG Real Estate Portal 2.0 Insecure Cookie...