70 matches found
File Store PRO 3.2 - Multiple Blind SQL Injections
File Store PRO 3.2 - Multiple Blind SQL Injections | File Store PRO 3.2 Blind SQL Injection | || Download from: http://upoint.info/cgi/demo/fs/filestore.zip - Need admin rights: /confirm.php: code ifisset$GET"folder" && $GET"folder"!="" $folder=$GET"folder"; else exit"Bad Request"; ifisset$GET"id...
[eVuln] @1 File Store Multiple XSS and SQL Injection Vulnerabilities
New eVuln Advisory: @1 File Store Multiple XSS and SQL Injection Vulnerabilities http://evuln.com/vulns/95/summary.html --------------------Summary---------------- eVuln ID: EV0095 Software: @1 File Store Sowtware's Web Site: http://www.upoint.info/cgi/download/ Versions: 2006.03.07 Critical Leve...
CVE-2006-1277
Cross-site scripting XSS vulnerability in signup.php in @1 File Store 2006.03.07 allows remote attackers to inject arbitrary web script or HTML via the 1 realname, 2 email, and 3 login parameters...
Sql injection
SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to 1 functions.php and 2 user.php in the libs directory, 3 edit.php and 4 delete.php in control/files/, 5 edit.php and 6 delete.php in control/users/, 7 edit.php,...
CVE-2006-1278
SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to 1 functions.php and 2 user.php in the libs directory, 3 edit.php and 4 delete.php in control/files/, 5 edit.php and 6 delete.php in control/users/, 7 edit.php,...
CVE-2006-1278
CVE-2006-1278 is a SQL injection in @1 File Store 2006.03.07 (also affecting FILE STORE PRO 3.2 for vectors 12–13) allowing remote attackers to execute arbitrary SQL via multiple input vectors across libs, control/files, control/users, control/folders, control/groups, as well as password.php and ...
CVE-2006-1278
SQL injection vulnerability in @1 File Store 2006.03.07 allows remote attackers to execute arbitrary SQL commands via the id parameter to 1 functions.php and 2 user.php in the libs directory, 3 edit.php and 4 delete.php in control/files/, 5 edit.php and 6 delete.php in control/users/, 7 edit.php,...
CVE-2006-1277
The CVE-2006-1277 entry describes a cross-site scripting (XSS) vulnerability in signup.php of @1 File Store 2006.03.07, where remote attackers can inject arbitrary web script or HTML via the real_name, email, or login parameters. The vulnerability is classified as XSS with a medium base score (CV...
security flaw
The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions...
