CVE-2008-0284

Cross-site scripting XSS vulnerability in Simple Machines Forum SMF 1.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via 1 Itemid or 2 topic arguments...

CVE-2008-0284

CVE-2008-0284 affects Simple Machines Forum (SMF) 1.1.4 and earlier. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the Itemid or topic parameters. Impact described as enabling script execution in the context of the a...

xforum-sql.txt

!/usr/bin/perl Xforum 1.4 Remote SQL Injection desc: Un forum php/MySQL, avec gestion complete des membres et des messages download: http://www.comscripts.com/scripts/php.xforum.1188.html d0rk: "xforum 1.4" bug found by j0j0 c0ded by j0j0 liretopic.php 68. $conn = connect; 69. $requete = "SELECT...

Xforum 1.4 - 'topic' SQL Injection

!/usr/bin/perl Xforum 1.4 Remote SQL Injection desc: Un forum php/MySQL, avec gestion complete des membres et des messages download: http://www.comscripts.com/scripts/php.xforum.1188.html d0rk: "xforum 1.4" bug found by j0j0 c0ded by j0j0 liretopic.php 68. $conn = connect; 69. $requete = "SELECT...

Simple Machines Forum Cross-Site Scripting Vulnerabilities Vulnerabilities

HSC Simple Machines Forum Cross-Site Scripting Vulnerabilities Vulnerabilities Simple Machines Forum allows attackers to exploiting this vulnerability by cross-site scripting and they will be able to obtain detailed information. This may help the attacker steal cookie-based authentication...

simple-xss.txt

HSC Simple Machines Forum Cross-Site Scripting Vulnerabilities Vulnerabilities Simple Machines Forum allows attackers to exploiting this vulnerability by cross-site scripting and they will be able to obtain detailed information. This may help the attacker steal cookie-based authentication...

Joomla! Component SMF Forum 1.1.4 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/27218/info Joomla-SMF Forum is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user ...

Sql injection

Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searchtext parameter to search.php, and unspecified other vectors...

CVE-2008-0099

Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searchtext parameter to search.php, and unspecified other vectors...

CVE-2008-0099

Affected software: MyPHP Forum 3.0 and earlier. Vulnerability: SQL injection in search.php (searchtext) and unspecified other vectors. Root cause: improper handling of user-supplied input enabling arbitrary SQL execution. Impact: remote attackers can perform SQL commands with partial confidential...

CVE-2008-0099

Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the searchtext parameter to search.php, and unspecified other vectors...

PortalApp40.txt

Title: PortalApp 4.0 Multiple vulnerabilities Discovered By: r3dm0v3 http://r3dm0v3.persianblog.ir r3dm0v3 4t yahoodotcom Tehran - Iran Vendor: http://www.portalapp.com Vulnerable Version: 4.0, prior versions maybe vulnerable Remote Exploit: Yes Dork: "Copyright @2007 Iatek LLC" Fix: Not Availabl...

ipb217-xsssql.txt

---- INVISION POWER BOARD 2.1.7 EXPLOIT ... ITDefence.ru Antichat.ru INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007 ////...

RunCMS Newbb_plus 0.92 - Client IP SQL Injection

RunCMS Newbbplus 0.92 - Client IP SQL Injection !/usr/bin/perl use Tk; use Tk::BrowseEntry; use Tk::DialogBox; use LWP::UserAgent; $mw = new MainWindowtitle = "UnderWHAT?!" ; $mw-geometry '420x383' ; $mw-resizable0,0; $mw-Label-text = '', -font = 'Verdana 8',-foreground='red'-pack; $mw-Label-text...

PortalApp 4.0 - SQL Injection Cross-Site Scripting Authentication Bypass

PortalApp 4.0 - SQL Injection Cross-Site Scripting Authentication Bypass Title: PortalApp 4.0 Multiple vulnerabilities Discovered By: r3dm0v3 http://r3dm0v3.persianblog.ir r3dm0v3 4t yahoodotcom Tehran - Iran Vendor: http://www.portalapp.com Vulnerable Version: 4.0, prior versions maybe vulnerabl...

PortalApp 4.0 - SQL Injection / Cross-Site Scripting / Authentication Bypass

Title: PortalApp 4.0 Multiple vulnerabilities Discovered By: r3dm0v3 http://r3dm0v3.persianblog.ir r3dm0v3 4t yahoodotcom Tehran - Iran Vendor: http://www.portalapp.com Vulnerable Version: 4.0, prior versions maybe vulnerable Remote Exploit: Yes Dork: "Copyright @2007 Iatek LLC" Fix: Not Availabl...

Invision Power Board <= 2.1.7 ACTIVE XSS/SQL Injection Exploit

No description provided by source. ---- INVISION POWER BOARD 2.1.7 EXPLOIT ... ITDefence.ru Antichat.ru INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / &nbs...

MyPHP Forum多个SQL注入漏洞

BUGTRAQ ID: 27118 MyPHP Forum是一个易于架设并且易于使用基于MySQL与PHP的论坛。 MyPHP Forum处理用户请求数据时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击。 MyPHP Forum的faq.php文件没有正确地验证对id参数的输入，member.php文件没有正确验证对member参数的输入，search.php文件没有正确验证对searchtext和searchuser参数的输入，允许攻击者通过注入任意SQL代码控制SQL查询。成功攻击要求禁用了magicquotesgpc。 faq.php文件中的漏洞代码：...

Tribisur <= 2.0 Remote SQL Injection Exploit

No description provided by source. !/usr/bin/php -q ?php echo "Tribisur = 2.0 Remote SQL Injection Exploit\r\n"; echo "Coded by x0kster -x0ksterATgmailDOTcom - \r\n"; / Script Download : http://www.comscripts.com/scripts/php.tribisur-20.1211.html Bug 1 in modules/forum/liste.php : First, this...

Tribisur 2.0 - SQL Injection

!/usr/bin/php -q And now the bugged code :- : So we can exploit it with this simple PoC: forum.php?action=liste&cat=-1+union+select+0,concatpseudo,0x3a,passe,0,0,0,0,0,0,0,0+from+utiliz+where+id=1 Bug 2 in catmain.php : So like the first we can exploit it with:...