CVE-2006-6090

CVE-2006-6090 documents multiple SQL injection vulnerabilities in the BaalAsp forum that allow remote attackers to execute arbitrary SQL commands via (1) the password parameter to adminlogin.asp, (2) the name or password parameter to userlogin.asp, or (3) the search parameter to search.asp. The N...

CVE-2006-6089

CVE-2006-6089 corresponds to multiple cross-site scripting (XSS) vulnerabilities in BaalAsp forum’s addpost1.asp. The flaws allow remote attackers to inject arbitrary script or HTML via the title/Subject, groupname/Group Name, or detail/Message fields. The affected software is BaalAsp forum (addp...

CVE-2006-6075

Cross-site scripting XSS vulnerability in addpost1.asp in BaalAsp forum allows remote attackers to inject arbitrary web script or HTML via the name parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6075

The CVE-2006-6075 entry describes a cross-site scripting (XSS) vulnerability in BaalAsp forum, specifically in addpost1.asp via the name parameter. The underlying issue is insufficient input handling that allows remote attackers to inject arbitrary script/HTML. CVSS v2 base score is 6.8 (Medium) ...

PT-2006-6734 · Baalasp · Baalasp Forum

Name of the Vulnerable Software and Affected Versions: BaalAsp forum affected versions not specified Description: The issue concerns multiple cross-site scripting XSS vulnerabilities in the addpost1.asp file of the BaalAsp forum. These vulnerabilities allow remote attackers to inject arbitrary we...

CVE-2006-6090: Undefined Security Weakness

Multiple SQL injection vulnerabilities in BaalAsp forum allow remote attackers to execute arbitrary SQL commands via the 1 password parameter to a adminlogin.asp, the 2 name or 3 password parameter to b userlogin.asp, or the 3 search parameter to search.asp...

CVE-2006-6089: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in addpost1.asp in BaalAsp forum allow remote attackers to inject arbitrary web script or HTML via the 1 title Subject, 2 groupname Group Name, or 3 detail Message field...

PT-2006-6735 · Baal · Baalasp Forum

Name of the Vulnerable Software and Affected Versions: BaalAsp forum affected versions not specified Description: The issue concerns multiple SQL injection vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary SQL commands. The vulnerabilities can be exploited through...

CVE-2006-6041: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Laurent Van den Reysen WORK system e-commerce 3.0.2, and other versions before 3.0.4, allow remote attackers to execute arbitrary PHP code via a URL in the ginclude parameter to 1 index.php, 2 module/forum/forum.php, 3 unspecified files under...

CVE-2006-6038: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in editpoll.php in Powie's PHP Forum pForum 1.29a and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

DeluxeBB sig.php远程文件包含漏洞

DeluxeBB是一款基于PHP的论坛程序。 DeluxeBB对用户请求的处理存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意指令。 DeluxeBB的templates/deluxe/cp/sig.php脚本没有对templatefolder参数做充分的检查过滤，允许攻击者通过恶意参数串包含远程服务器上的脚本代码执行。 DeluxeBB DeluxeBB 1.09 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： DeluxeBB hotfixfor109.zip...

Powie's PHP Forum <= v1.29a (editpoll) Remote SQL Injection Exploit

============================================================================================== Powie's PHP Forum = v1.29a editpoll Remote SQL Injection Exploit =============================================================================================== Critical Level : Dangerous Venedor site :...

Use the file header trick to get WebShell-vulnerability warning-the black bar safety net

Brother first timers,do not understand place,please Hai Han ! Administrator, boss,don't delete my posts ha...deleted before to consider your own safety haha. Purely a joke. Fee words not say more,start the chase ! Tomorrow to the exam,anyway, tomorrow exam hang a set,I also no longer do unnecessa...

BaalAsp forum [login bypass ,injections sql(post), xss(post)]

vendor site:http://baalasp.com/ product:BaalAsp forum bug:login bypass, injection sql post, xss post risk:high authentification bypass : admin login bypass == /adminlogin.asp passwd: 'or''=' user login bypass == /userlogin.asp user: 'or''=' passwd: 'or''=' injection sql post == /search.asp...

baalasp.txt

vendor site:http://baalasp.com/ product:BaalAsp forum bug:login bypass, injection sql post, xss post risk:high authentification bypass : admin login bypass == /adminlogin.asp passwd: 'or''=' user login bypass == /userlogin.asp user: 'or''=' passwd: 'or''=' injection sql post == /search.asp...

CVE-2006-5909: Undefined Security Weakness

generaloptions.php in Paul Tarjan Stanford Conference And Research Forum SCARF before 20070227 does not require the admin privilege, which allows remote attackers to reconfigure the application or its user accounts...

New Bug MiniBB Forum <= 2 Remote File Include (index.php)

Title : MiniBB Forum = 2 Remote File Include index.php Discovered By :::: ThE-LoRd-Of-CrAcKiNg MeHdi ------------------------------------------------------------------------ Sorce Code: http://www.minibb.net/download.php?file=minibb20 ----- Affected software description : Application : MiniBB For...

sunForumXSS.txt

Sun, in their amazing patheticness, have again allowed direct HTML to be written into their forum system. URL: http://forum.java.sun.com/forum.jspa?forumID=553 It works on only select forums, but due to severe incompetence from the administrators of the site, this issue will occur quit often. It ...

minibb2-rfi.txt

Title : MiniBB Forum = 2 Remote File Include index.php Discovered By :::: ThE-LoRd-Of-CrAcKiNg MeHdi ------------------------------------------------------------------------ Sorce Code: http://www.minibb.net/download.php?file=minibb20 ----- Affected software description : Application : MiniBB For...

Update Protection against W-Agora 'inc_dir' Parameter Remote File Inclusion Vulnerabilities

W-Agora is an open source web publishing and forum software. It allows web administrators and their visitors to store and display messages, files, share discussions and other information on the web site. W-Agora is prone to multiple remote file inclusion vulnerabilities. An attacker can exploit...