7169 matches found
SoftBB多个远程代码执行及信息泄露漏洞
SoftBB是一款基于WEB的论坛程序。 SoftBB v0.1中存在多个输入验证错误，如下： 1 在SQL查询时没有正确的验证对/addmembre.php文件中groupe参数及/moveto.php文件中select参数的输入，允许攻击者执行SQL注入攻击。 2 在PHP脚本中存储之前没有正确过滤对admin/saveopt.php中多个参数的输入，允许攻击者执行任意PHP代码。成功攻击可能要求管理员权限。 3 对index.php中page参数的输入没有正确的处理空的或无效的参数，允许攻击者判断安装路径。 SoftBB = 0.1...
MiniHTTPServer Web Forum & File Sharing Server 4.0 - Add User
/================================================================ MiniHTTPServer.NET 's Web Forum & File Sharing Server Power Pack 4 latest version available for sale on their website http://www.minihttpserver.net/bbs/index.php has multiple vulnerabilities with their join.asp page a malicious...
Berty Forum 1.4 - index.php Blind SQL Injection
Berty Forum 1.4 - index.php Blind SQL Injection exploit1.asp 'Using : Write Target and ID after Submit Click '=============================================================================================== % Berty Forum v1.4index.php Blind SQL Injection Exploit function functionControl1...
Berty Forum <= 1.4 (index.php) Remote Blind SQL Injection Exploit
Exploit for unknown platform in category web applications ================================================================= Berty Forum exploit1.asp 'Using : Write Target and ID after Submit Click '=============================================================================================== %...
Berty Forum 1.4 - 'index.php' Blind SQL Injection
exploit1.asp 'Using : Write Target and ID after Submit Click '=============================================================================================== % Berty Forum v1.4index.php Blind SQL Injection Exploit function functionControl1 setTimeout"functionControl2",2000; function...
WSN Forum <= 1.3.4 (pathtoconfig) Remote File Include Exploit / Code Execution Vulnerability
!/usr/bin/php -q -d shortopentag=on ? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:+...
[DRUPAL-SA-2006-024] Drupal 4.6.10 / 4.7.4 fixes multiple XSS issues
------------------------------------------------------------------------ ---- Drupal security advisory DRUPAL-SA-2006-024 ------------------------------------------------------------------------ ---- Project: Drupal core Date: 2006-Oct-18 Security risk: Moderately critical Exploitable from: Remot...
[Xss] IN SMF 1.1 RC2
InFo ----- Site : www.simplemachines.org Dork : Powered by SMF 1.1 RC2 File : index.php? By : b0rizQ E-Mail : TheFreEKernEl at b0rizQ dot nET email concealed -------------------------------- Xss www.traget.com/index.php?action=login2"scriptalert'xss-by-b0rizQ' /script...
CVE-2006-5438
PHP remote file inclusion vulnerability in adminfoot.php in Comdev Forum 4.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter. NOTE: the provenance of this information is unknown; the details are obtained from third par...
CVE-2006-5438
PHP remote file inclusion vulnerability in adminfoot.php in Comdev Forum 4.1, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pathdocroot parameter. NOTE: the provenance of this information is unknown; the details are obtained from third par...
CVE-2006-5438
CVE-2006-5438 : PHP remote file inclusion in adminfoot.php of Comdev Forum 4.1 when register_globals is enabled. An attacker can supply a URL in the path[docroot] parameter to execute arbitrary PHP code remotely. The provided documents do not include explicit remediation steps. Exploitation statu...
CVE-2006-5421
WSN Forum 1.3.4 and earlier allows remote attackers to execute arbitrary PHP code via a modified pathname in the pathtoconfig parameter that points to an avatar image that contains PHP code, which is then accessed from prestart.php. NOTE: this issue has been labeled remote file inclusion, but tha...
CVE-2006-5421
WSN Forum 1.3.4 and earlier allows remote attackers to execute arbitrary PHP code via a modified pathname in the pathtoconfig parameter that points to an avatar image that contains PHP code, which is then accessed from prestart.php. NOTE: this issue has been labeled remote file inclusion, but tha...
CVE-2006-5421
CVE-2006-5421 affects WSN Forum 1.3.4 and earlier. The vulnerability arises when a modified pathname in the pathtoconfig parameter points to an avatar image containing PHP code, which is then accessed by prestart.php, allowing remote attackers to execute arbitrary PHP code. The underlying issue i...
FreeBSD : drupal -- multiple XSS vulnerabilities (b2383758-5f15-11db-ae08-0008743bf21a)
The Drupal Team reports : A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This...
Hacking tutorials series of micro-PHP Trojan explore-exploit warning-the black bar safety net
This article is nothing special, only required to initiate it. And gave and I did the dishes in PHP the door and wandering friend. Just learning PHP in a few days, I would rush to work, so there are errors and inadequacies Please a positive note. PHP syntax powerful is ASP in the dust, only one:...
CS-Forum 0.82 (ajouter.php) Remote File Include Vulnerability
CS-Forum 0.82 ajouter.php Remote File Include Vulnerability Source Code: http://www.comscripts.com/jump.php?action=script&id=643 Vulnerable Code: include"$include/footer.php"; Exploit : http://www.vicTim.com/CS-Forum/ajouter.php?include=shell.txt? Discoverd By : Mahmoodali Conatact : mahk2000 at...
drupal -- multiple XSS vulnerabilities
The Drupal Team reports: A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS attack via a specially crafted RSS feed. This...
DRUPAL-SA-2006-024 - Drupal core - Multiple cross site scripting vulnerabilities
Multiple XSS cross site scripting vulnerabilities have been discovered. A bug in input validation and lack of output validation allows HTML and script insertion on several pages. Drupal's XML parser passes unescaped data to watchdog under certain circumstances. A malicious user may execute an XSS...
WSN Forum 1.3.4 - prestart.php Remote Code Execution
WSN Forum 1.3.4 - prestart.php Remote Code Execution !/usr/bin/php -q -d shortopentag=on ? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::...