CVE-2006-5630

Hosting Controller 6.1 before Hotfix 3.3 allows remote attackers to 1 delete the virtual directory of an arbitrary site via a modified ForumID parameter in a disableforum action in DisableForum.asp and 2 create an arbitrary forum virtual directory via an empty ForumID parameter in an enableforum...

CVE-2006-5630

CVE-2006-5630 affects Hosting Controller 6.1 before Hotfix 3.3. The vulnerability enables remote deletion of a site’s virtual directory by tampering with the ForumID in DisableForum.asp, and creation of an arbitrary forum virtual directory via an empty ForumID in EnableForum.asp. Root cause: impr...

Web Wiz Forums forum/search.asp KW Parameter SQL Injection (deprecated)

Binary data 3801.prm...

Hosting Controller 6.1 Hotfix <= 3.2 Vulnerability

Hosting Controller 'EnableForum.asp' and 'DisableForum.asp' Scripts Let Remote Users Create or Delete Forums and Virtual Directories advisory : http://www.kapda.ir/advisory-442.html http://securitytracker.com/alerts/2006/Oct/1017103.html...

Easy File Sharing Web Server 4 - Remote Information Stealer

Easy File Sharing Web Server 4 - Remote Information Stealer / =================================================================== 0-day Alternative File Stream Exploit for Easy File Share Server 4 =================================================================== Exploit allows malicious users t...

动网论坛DVBBS) logout.asp页面存在注入漏洞

logout.asp: /-------------------------------------------------------------------------- /-------------------------------------------------------------------------- 因程序当中的logout.asp页面对于 activeuser="delete from online where username='"&membername&"'"并没有做好过滤导致了问题的产生, DVBBS 请安装最新动网论坛...

YABBSE多个跨站脚本执行漏洞(CSS/XSS)

Yabb Se是一款基于PHP/MySQL的论坛程序。 YaBB SE由于不正确的过滤glow和shadow标记，远程攻击者可以利用这个漏洞进行跨站脚本执行攻击，导致敏感信息泄露。 在glow和shadow标记中加入恶意脚本代码，当浏览者读取包含此链接的页面，无需打开就会导致恶意脚本代码在用户浏览器上执行，可使目标用户敏感信息泄露。 YaBB Simple Machines SMF 1.0 b SE 1.5.1 Gold - SP 1.3 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： frog-m@n提供如下第三方补丁： 使用...

PHPWIND论坛存在严重安全隐患

PHPWIND论坛是一个采用 PHP 和 MySQL 等其他多种数据库构建的高效论坛解决方案。 PHPWIND存在严重安全隐患，会导致恶意用户可以得到论坛最高权限！ PHPWIND 4.3.2 – PHPWIND 5.0.0 Beta 暂未发布任何安全补丁。 请到官方下载最新版本。...

动网(DVBBS)论坛上传文件漏洞

upfile.asp中有这样一句 formPath&yearnow&monthnow&daynow&hournow&minutenow&secondnow&ranNum&"."&fileExt...

PHPWIND 2.0.1论坛直接写入木马漏洞

在程序运行时，我抓了一个包： GET /phpwind/job.php?previewjob=preview&Dname=./attachment/set.php&tidwt= chr46.chr47.chr101.chr114.chr114.chr111.chr114.chr46.chr112.chr104.chr112,w, chr60.chr63.chr32.chr101.chr118.chr97.chr108.chr40.chr36.chr95.chr80.chr79...

PHPWIND1.3.6论坛skin变量未过滤导致管理员密码更改漏洞

PHPWIND论坛是一款流行的PHP论坛，界面美观，功能也比较强大。但大家仔细看一下会发现不论是从界面功能还是代码风格，它和DISCUZ都非常相似，具体原因我想也就不用说了，毕竟DISCUZ出来比它要早很多。但安全上它没有继承DISCUZ的优点，DISCUZ论坛安全性非常好，而且商家也对此非常重视安全问题，国内论坛中不论从功能还是安全,第一非DISCUZ莫属。PHPWIND虽然代码严谨，逻辑清楚，但还是有一些漏洞，而且还相当严重。 skin变量未过滤导致管理员密码更改 漏洞代码如下header.php： !functionexists'readover' &&...

CVE-2006-5597

CVE-2006-5597 affects MiniHTTP Web Forum & File Server PowerPack 4.0. The join.asp endpoint is vulnerable to remote manipulation of user accounts via modified parameters (1) frmMailBox and (2) frmUserPass), allowing an attacker to add or modify arbitrary accounts. The description and references i...

CVE-2006-5597

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

CVE-2006-5597: Undefined Security Weakness

join.asp in MiniHTTP Web Forum & File Server PowerPack 4.0 allows remote attackers to add or modify arbitrary user accounts via modified 1 frmMailBox and 2 frmUserPass parameters...

MiniHTTPServer Web Forum绕过认证添加用户漏洞

Web Forum & File Sharing Server允许用户在Internet上创建自己的论坛。 Web Forum & File Server在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞非授权操作论坛。 Web Forum & File Server的join.asp文件没有正确验证frmMailBox参数数据的输入，允许攻击者未经授权便以PowerUser的权限添加新的论坛用户。 Mini HTTP Server Web Forum & File Sharing Server 4.0...

Web Wiz Forum 6.347.x - search.asp SQL Injection

Web Wiz Forum 6.347.x - search.asp SQL Injection source: https://www.securityfocus.com/bid/20778/info Web Wiz Forum is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow a...

Web Wiz Forum 6.34/7.x - 'search.asp' SQL Injection

source: https://www.securityfocus.com/bid/20778/info Web Wiz Forum is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access ...

ASPPlayGround.NET Forum 2.4.5 - Calendar.asp Cross-Site Scripting

ASPPlayGround.NET Forum 2.4.5 - Calendar.asp Cross-Site Scripting source: https://www.securityfocus.com/bid/20335/info ASPPlayground.NET Forum Advanced Edition is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage...

Hosting Controller 6.1 Hotfix 3.2 - Access

Hosting Controller 6.1 Hotfix = 3.2 Multi Vuln. SQLInjection, Command Injection ------- KAPDA::59 - Hosting Controller 6.1 Hotfix = 3.2 Vendor: Hosting Controller Vendor URL: www.hostingcontroller.com Solution: Hotfix 3.3 Found Date: 7/1/2006 Release Date: 10/10/2006 Discussion:...

MiniHttpServer Web Forum & File Sharing Server 4.0 Add User Exploit

No description provided by source. /================================================================ MiniHTTPServer.NET 's Web Forum & File Sharing Server Power Pack 4 latest version available for sale on their website http://www.minihttpserver.net/bbs/index.php has multiple vulnerabilities with...