Vanilla Forums 2-0-18-4 - SQL Injection

Vanilla Forums 2-0-18-4 - SQL Injection Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable Date: 04/05/2013 Exploit Author: bl4ckw0rm Vendor Homepage: http://vanillaforums.org/ Version: 2-0-18-4 Tested on: Windows Product Name: Vanilla Forums Vulnerable Version...

Vanilla Forums 2.0.18.4 SQL Injection

Product Name: Vanilla Forums Vulnerable Version: Up to vanilla-core-2-0-18-4 Tested on: Windows Server 2003 Apache 2.4.3 PHP 5.4.7 MySQL 5.5.27 Vulnerability Overview: SQL-Injection is possible, because$POST arrays are not proper sanitized. You do not need to be authenticated. Vulnerability...

Vanilla Forums 2-0-18-4 - SQL Injection

Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable Date: 04/05/2013 Exploit Author: bl4ckw0rm Vendor Homepage: http://vanillaforums.org/ Version: 2-0-18-4 Tested on: Windows Product Name: Vanilla Forums Vulnerable Version: Up to vanilla-core-2-0-18-4 Tested on:...

Clues About Flashback Creator Come Together

Nearly a year since the Flashback Trojan surfaced and ultimately infected more than 600,000 Apple OS X computers, the author of the malware may haven been discovered. After some sleuthing by security bloggers Brian Krebs over the past year – documented today on the Krebs on Security blog – the...

Skype Community - Persistent Editor Web Vulnerability

Document Title: =============== Skype Community - Persistent Editor Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=707 MICROSOFT SECURITY RESPONSE CENTER MSRC ID: 13021bc Release Date: ============= 2013-03-28 Vulnerability Laboratory ...

Skype Community Cross Site Scripting

Title: ====== Skype Community - Mail Encoding Web Vulnerability Date: ===== 2013-02-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=800 MSRC ID: 13493 VL-ID: ===== 800 Common Vulnerability Scoring System: ==================================== 3.5 Introduction:...

Cross Platform Trojan builder distributed on underground forums

A Cross platform back door 'Frutas' remote access tool RAT is available for download on many forums from January 2013. This Trojan builder is completely written in Java. Recently, Symantec experts analyse that Frutas RAT allows attackers to create a connect-back client JAR file to run on a...

Forums Plugin for WordPress 'url' Parameter Arbitrary File Disclosure

The Forums Plugin for WordPress installed on the remote host is affected by an information disclosure vulnerability due to a failure to properly sanitize user-supplied input to the 'url' parameter of the zingforumoutput function in the zingiri-forum/forum.php script. An unauthenticated, remote...

WordPress Plugin Zingiri Forums - language Local File Inclusion

WordPress Plugin Zingiri Forums - language Local File Inclusion source: https://www.securityfocus.com/bid/56777/info The Zingiri Forums plugin for WordPress is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this...

WordPress Zingiri Forums Plugin - Local File Include

Zingiri Forums plugin is prone to a local file include vulnerability. It allows an attacker to view files and execute local scripts in the context of the web server process. Solution Update the plugin...

WordPress Plugin Zingiri Forums - 'language' Local File Inclusion

source: https://www.securityfocus.com/bid/56777/info The Zingiri Forums plugin for WordPress is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this vulnerability to view files and execute local scripts in the...

Why you should try to join some of the underground hacker forums that are out there

Even if you are considered to be a white hat hacker, you are always still walking a fine line between being a bad guy and a good guy in many people eyes. There are a lot of people out there who believe that there should be no hacking at all being done and everyone who does it should be considered...

FBI Warns of New Twist to Reveton, Citadel Malware Scams

The cybercrime group behind the Citadel malware and Reveton ransomware has upped the stakes with a new extortion technique, the FBI’s Internet Crime Complaint Center said today. Reveton scams have now co-opted the Internet Crime Complaint Center with a new fake warning to users whose computers ha...

Skype Community Body / Title Cross Site Scripting

Title: ====== Skype Community - Mail Encoding Web Vulnerability 1 Date: ===== 2012-11-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=708 MICROSOFT SECURITY RESPONSE CENTER MSRC ID: 13021bc VL-ID: ===== 708 Common Vulnerability Scoring System:...

Skype Community - Mail Encoding Web Vulnerability #2

Document Title: =============== Skype Community - Mail Encoding Web Vulnerability 2 References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=719 MICROSOFT SECURITY RESPONSE CENTER MSRC ID: 13022 & 13034 Release Date: ============= 2012-11-20 Vulnerability...

Skype Community - Mail Encoding Web Vulnerability #2

Document Title: =============== Skype Community - Mail Encoding Web Vulnerability 2 References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=719 MICROSOFT SECURITY RESPONSE CENTER MSRC ID: 13022 & 13034 Release Date: ============= 2012-11-20 Vulnerability...

Skype Community - Mail Encoding Web Vulnerability #1

Document Title: =============== Skype Community - Mail Encoding Web Vulnerability 1 References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=708 MICROSOFT SECURITY RESPONSE CENTER MSRC ID: 13022 & 13034 Release Date: ============= 2012-11-19 Vulnerability...

CVE-2012-4954

The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue...

Design/Logic Flaw

The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue...

CVE-2012-4954

Summary (evidence-based): Vanilla Forums, prior to version 2.1a32, is affected by a parameter manipulation vulnerability on the edit-profile page. An authenticated attacker who can perform a man-in-the-middle attack can replace the target UserID and modify arbitrary profile settings, including th...