Web Wiz Forums forum/search.asp KW Parameter SQL Injection (deprecated)

Binary data 3801.prm...

YABBSE多个跨站脚本执行漏洞(CSS/XSS)

Yabb Se是一款基于PHP/MySQL的论坛程序。 YaBB SE由于不正确的过滤glow和shadow标记，远程攻击者可以利用这个漏洞进行跨站脚本执行攻击，导致敏感信息泄露。 在glow和shadow标记中加入恶意脚本代码，当浏览者读取包含此链接的页面，无需打开就会导致恶意脚本代码在用户浏览器上执行，可使目标用户敏感信息泄露。 YaBB Simple Machines SMF 1.0 b SE 1.5.1 Gold - SP 1.3 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： frog-m@n提供如下第三方补丁： 使用...

动网论坛DVBBS) logout.asp页面存在注入漏洞

logout.asp: /-------------------------------------------------------------------------- /-------------------------------------------------------------------------- 因程序当中的logout.asp页面对于 activeuser="delete from online where username='"&membername&"'"并没有做好过滤导致了问题的产生, DVBBS 请安装最新动网论坛...

动网(DVBBS)论坛上传文件漏洞

upfile.asp中有这样一句 formPath&yearnow&monthnow&daynow&hournow&minutenow&secondnow&ranNum&"."&fileExt...

PHPWIND论坛存在严重安全隐患

PHPWIND论坛是一个采用 PHP 和 MySQL 等其他多种数据库构建的高效论坛解决方案。 PHPWIND存在严重安全隐患，会导致恶意用户可以得到论坛最高权限！ PHPWIND 4.3.2 – PHPWIND 5.0.0 Beta 暂未发布任何安全补丁。 请到官方下载最新版本。...

PHPWIND1.3.6论坛skin变量未过滤导致管理员密码更改漏洞

PHPWIND论坛是一款流行的PHP论坛，界面美观，功能也比较强大。但大家仔细看一下会发现不论是从界面功能还是代码风格，它和DISCUZ都非常相似，具体原因我想也就不用说了，毕竟DISCUZ出来比它要早很多。但安全上它没有继承DISCUZ的优点，DISCUZ论坛安全性非常好，而且商家也对此非常重视安全问题，国内论坛中不论从功能还是安全,第一非DISCUZ莫属。PHPWIND虽然代码严谨，逻辑清楚，但还是有一些漏洞，而且还相当严重。 skin变量未过滤导致管理员密码更改 漏洞代码如下header.php： !functionexists'readover' &&...

PHPWIND 2.0.1论坛直接写入木马漏洞

在程序运行时，我抓了一个包： GET /phpwind/job.php?previewjob=preview&Dname=./attachment/set.php&tidwt= chr46.chr47.chr101.chr114.chr114.chr111.chr114.chr46.chr112.chr104.chr112,w, chr60.chr63.chr32.chr101.chr118.chr97.chr108.chr40.chr36.chr95.chr80.chr79...

Web Wiz Forum 6.347.x - search.asp SQL Injection

Web Wiz Forum 6.347.x - search.asp SQL Injection source: https://www.securityfocus.com/bid/20778/info Web Wiz Forum is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow a...

MiniHTTPServer Web Forum绕过认证添加用户漏洞

Web Forum & File Sharing Server允许用户在Internet上创建自己的论坛。 Web Forum & File Server在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞非授权操作论坛。 Web Forum & File Server的join.asp文件没有正确验证frmMailBox参数数据的输入，允许攻击者未经授权便以PowerUser的权限添加新的论坛用户。 Mini HTTP Server Web Forum & File Sharing Server 4.0...

CVE-2006-5597

CVE-2006-5597 affects MiniHTTP Web Forum & File Server PowerPack 4.0. The join.asp endpoint is vulnerable to remote manipulation of user accounts via modified parameters (1) frmMailBox and (2) frmUserPass), allowing an attacker to add or modify arbitrary accounts. The description and references i...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

Web Wiz Forum 6.34/7.x - 'search.asp' SQL Injection

source: https://www.securityfocus.com/bid/20778/info Web Wiz Forum is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access ...

ASPPlayGround.NET Forum 2.4.5 - Calendar.asp Cross-Site Scripting

ASPPlayGround.NET Forum 2.4.5 - Calendar.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/20335/info ASPPlayground.NET Forum Advanced Edition is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage...

Hosting Controller 6.1 Hotfix 3.2 - Access

Hosting Controller 6.1 Hotfix = 3.2 Multi Vuln. SQLInjection, Command Injection ------- KAPDA::59 - Hosting Controller 6.1 Hotfix = 3.2 Vendor: Hosting Controller Vendor URL: www.hostingcontroller.com Solution: Hotfix 3.3 Found Date: 7/1/2006 Release Date: 10/10/2006 Discussion:...

MiniHttpServer Web Forum & File Sharing Server 4.0 Add User Exploit

No description provided by source. /================================================================ MiniHTTPServer.NET 's Web Forum & File Sharing Server Power Pack 4 latest version available for sale on their website http://www.minihttpserver.net/bbs/index.php has multiple vulnerabilities with...

CVE-2006-5503

Cross-site scripting XSS vulnerability in index.php in Simple Machines Forum SMF 1.1 RC2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

MiniHTTPServer Web Forum File Sharing Server 4.0 - Add User

MiniHTTPServer Web Forum File Sharing Server 4.0 - Add User /================================================================ MiniHTTPServer.NET 's Web Forum & File Sharing Server Power Pack 4 latest version available for sale on their website http://www.minihttpserver.net/bbs/index.php has...

Berty Forum <= 1.4 (index.php) Remote Blind SQL Injection Exploit

No description provided by source. % Response.Buffer = True % % On Error Resume Next % % Server.ScriptTimeout = 100 % % '=============================================================================================== 'Script Name: Berty Forum = 1.4index.php Remote Blind SQL Injection Exploit 'Cod...

MiniHttpServer Web Forum & File Sharing Server 4.0 Add User Exploit

Exploit for unknown platform in category remote exploits =================================================================== MiniHttpServer Web Forum & File Sharing Server 4.0 Add User Exploit ===================================================================...

TR Forum SQL注入及认证绕过漏洞

Tr Forum是一款法语的论坛程序。 Tr Forum中的多个漏洞允许恶意用户执行SQL注入攻击和绕过某些安全限制。 1 admin/insertadmin.php文件中缺少认证，允许创建拥有有限权限的管理员帐号。 2 没有正确过滤对admin/editer.php文件中id2参数的输入，允许攻击者通过注入任意SQL代码操控SQL查询。成功攻击要求某些管理权限。 3 在更新配置文件时缺少访问验证，允许通过更改id参数修改其他用户的设置。 组合使用1和2所述漏洞允许以完全权限访问管理部分。 Tr Forum Tr Forum 2.0 我们建议使用此软件的用户随时关注厂商的主页以获取最新版...