CVE-2008-6890: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in messages.asp in ASP Forum Script allows remote attackers to execute arbitrary SQL commands via the messageid parameter...

Alternative get 94kk Forum administrator password to get the shell-vulnerability warning-the black bar safety net

Excerpt from: Qglfnt's Blog Not much to say, directly into the topic. Can to on Google to the“Powered by 94kk 2.1.0”this is 94KKBBS the latest edition, as a keyword search. Just find a forum, click on“login”in the login do not fill in the user name and password, but directly click on the“Forgot...

AJ HYPE PRIME SQL Injection

/ AJ HYPE PRIME id Remote SQL Injection Vulnerability Discovered by : MizoZ Contact : [email protected] Team : EvilWay Date : July 29 2009 Greetings : Moudi , Zuka, All friends / SQL Injection welcome.php GET : id : HOST/PATH/forum/welcome.php?id=SQL CODE SQL CODE :...

Miniweb 2.0 Forum XSS

-----------------------------I AM MUSLIM !!------------------------------ ============================================================================== / \ | | | | / \ | | | | / \ | | | | / \ | || | / \ | | | | / \ | | IN THE NAME OF // \ || || // \ || ||...

almond Classifieds ads - Blind SQL Injection / Cross-Site Scripting

-----------------------------I AM MUSLIM !!------------------------------ ============================================================================== / \ | | | | / \ | | | | / \ | | | | / \ | || | / \ | | | | / \ | | IN THE NAME OF // \ || || // \ || ||...

Wmshop 6.0 Password Disclosure

Cyber-Warrior & Security TIM - Bug Researchers Group Application Name : Wmshop 6.0 - 5.08 Vulnerable Type : Arbitrary Forum Password Disclosure Vulnerability Infection : Forum Password Get... Author : Septemb0x Script Down.& WebSite : http://s2.dosya.tc/wmshop6.0.rar.html -...

Phorum 5.2.11 Cross Site Scripting

//----- Advisory Program : Phorum 5.2.11 Homepage : http://www.phorum.org/ Discovery : 2009/07/16 Author Contacted : 2009/07/17 Found by : crashfr at sysdream dot com This Advisory : crashfr at sysdream dot com //----- Application description Started in 1998, Phorum was the original PHP and MySQL...

Meta Search Engine Script - 'url' Local File Disclosure

-----------------------------I AM MUSLIM !!------------------------------ ============================================================================== / \ | | | | / \ | | | | / \ | | | | / \ | || | / \ | | | | / \ | | IN THE NAME OF // \ || || // \ || ||...

CVE-2009-2545

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Sql injection

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2546

Directory traversal in Advanced Electron Forum (AEF) 1.x allows remote attackers to determine whether arbitrary files exist via the avatargalfile parameter when changing an avatar, causing information disclosure through error messages. No patch or remediation is stated in the provided documents.

CVE-2009-2545

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2545

CVE-2009-2545 describes an SQL injection in Advanced Electron Forum (AEF) 1.x when magic_quotes_gpc is disabled. The vulnerability allows remote attackers to inject arbitrary SQL through the filename field of an uploaded attachment. The available documents confirm the affected software and the un...

CVE-2009-2546: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Advanced Electron Forum AEF 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance of this information i...

CVE-2009-2545: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

NullLogic Groupware <= 1.2.7 Multiple Vulnerabilities - Linux

NullLogic Groupware is prone to multiple vulnerabilities. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

FreeBSD : drupal -- multiple vulnerabilities (be927298-6f97-11de-b444-001372fd0af2)

The Drupal Security Team reports : Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages...

NullLogic Groupware多个远程安全漏洞

CVECAN ID: CVE-2009-2354,CVE-2009-2355,CVE-2009-2356 Groupware是一个开源的团队协作软件，包含有即时消息、公共论坛、邮件等多种功能。 远程攻击者可以通过向Groupware的多个模块提交恶意参数请求导致拒绝服务或执行任意代码。 1 Groupware在与数据库服务器通讯时通常会调用sqlqueryf函数，该函数会使用C格式字符串和其他参数来创建SQL查询。例如，在试图登录的时候，authcheckpass函数会生成以下查询： if sqr=sqlqueryfsid, "SELECT userid, password FROM...

Cross site scripting

Cross-site scripting XSS vulnerability in PHPEcho CMS 2.0-rc3 allows remote attackers to inject arbitrary web script or HTML via a forum post...

Sql injection

SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355...