vBulletin Announcements Cookie Steal Vulnerability

If you get access to a forum with an acc that only has default acp, you can get all users information by creating a cookie stealer in announcements. vBulletin Announcements, by default has html enabled, so if you get access to a forum using other exploits and get a user with acp info, but it only...

snitz-sql.txt

WwW.BugReport.IR AmnPardaz Security Research & Penetration Testing Group Title: A user can gain admin level in snitz 2000 by SQL Injection vendor: http://forum.snitz.com/ Googling: "Powered by Snitz" 2,440,000 victims Last bug report in 2007-02-16 with 4692 visitors Exploit: Available Fix...

vBulletin Mod RPG Inferno 2.4 - 'inferno.php' SQL Injection

--==+================================================================================+==-- --==+ RPG Inferno v2.4 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

invision215-SQL.txt

!/usr/bin/perl IPB =2.1.4 exploit possibly 2.1.5 too Brought to you by the Ykstortion security team. The bug is in the pm system so you must have a registered user. The exploit will extract a password hash from the forum's data base of the target user. You need to know the target user's member ID...

CVE-2002-2054

CVE-2002-2054 affects TeeKai Forum 1.2. Remote attackers can authenticate as the administrator and gain privileged web forum access by setting the valid_level cookie to admin. Exploitation details are not expanded in the provided documents beyond cookie manipulation; no remediation steps are spec...

CVE-2003-1176: Undefined Security Weakness

postmessageform.asp in Web Wiz Forums 6.34 through 7.5, when quote mode is used, allows remote attackers to read or write to private forums by modifying the FID forum ID parameter...

CVE-2005-0345

viewthread.php in php-fusion 4.x does not check the 1 forumid or 2 forumcat parameters, which allows remote attackers to view protected forums via the threadid parameter...

PHP-Fusion < 5.00 viewthread.php Arbitrary Message Thread / Forum Access

A vulnerability exists in the version of PHP-Fusion installed on the remote host that may allow an attacker to read the contents of arbitrary forums and threads, regardless of the attacker's privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...