CVE-2013-3527

Vanilla Forums suffers SQL injection in versions before 2.0.18.8. The vulnerability allows remote attackers to inject arbitrary SQL via the Form/Email parameter array during entry/signin or entry/passwordrequest, potentially compromising data. Affected component: Vanilla Forums core (web applicat...

PT-2013-4458

Name of the Vulnerable Software and Affected Versions Vanilla Forums versions prior to 2.0.18.8 Description The issue is related to "object injection" and has remote attack vectors, but the specific impact is not specified. Recommendations For versions prior to 2.0.18.8, update to version 2.0.18....

PT-2013-4457

Name of the Vulnerable Software and Affected Versions Vanilla Forums versions prior to 2.0.18.8 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the name parameter in the Form/Email array to either the "entry/signin" or "entry/passwordrequest"...

CVE-2013-3527: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Vanilla Forums before 2.0.18.8 allow remote attackers to execute arbitrary SQL commands via the parameter name in the Form/Email array to 1 entry/signin or 2 entry/passwordrequest...

CVE-2013-3528: Undefined Security Weakness

Unspecified vulnerability in the update check in Vanilla Forums before 2.0.18.8 has unspecified impact and remote attack vectors, related to "object injection."...

Sony PSN Community - Mail Encoding Web Vulnerability

Document Title: =============== Sony PSN Community - Mail Encoding Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=748 Release Date: ============= 2013-05-06 Vulnerability Laboratory ID VL-ID: ==================================== 748...

Sony PSN Community - Mail Encoding Web Vulnerability

Document Title: =============== Sony PSN Community - Mail Encoding Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=748 Release Date: ============= 2013-05-06 Vulnerability Laboratory ID VL-ID: ==================================== 748...

Vanilla Forums 2.0.18 / SQL-Injection / Insert arbitrary user & dump usertable

Product Name: Vanilla Forums Vulnerable Version: Up to vanilla-core-2-0-18-4 Tested on: Windows Server 2003 Apache 2.4.3 PHP 5.4.7 MySQL 5.5.27 Vulnerability Overview: SQL-Injection is possible, because$POST arrays are not proper sanitized. You do not need to be authenticated. Vulnerability...

Sony PSN Community - Mail Encoding Web Vulnerability

Document Title: =============== Sony PSN Community - Mail Encoding Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=748 Release Date: ============= 2013-05-05 Vulnerability Laboratory ID VL-ID: ==================================== 747...

Sony PSN Community - Mail Encoding Web Vulnerability

Document Title: =============== Sony PSN Community - Mail Encoding Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=748 Release Date: ============= 2013-05-05 Vulnerability Laboratory ID VL-ID: ==================================== 747...

Sony PSN Community - Persistent Web Vulnerability

Document Title: =============== Sony PSN Community - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=746 Release Date: ============= 2013-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 746 Commo...

Fraud-as-a-Service of Zeus Malware advertised on social network

Cyber crime enterprise is showing a growing interest in monetization of botnets, the most targeted sector in recent months is banking. One of most active malware that still menaces Banking sector is the popular Zeus. Zeus is one of the oldest, it is active since 2007, and most prolific malware th...

Vanilla Forums Van2Shout 1.0.51 Cross Site Request Forgery

Exploit Title: Vanilla Forums where 1337 is the id. Bookmark CSRF: http://site.org/index.php=/vanilla/discussion/bookmark/1337 UnBookmark CSRF http://site.org/index.php=/vanilla/discussion/bookmark/1337? Delete Message CSRF http://site.org/index.php=/messages/clear/1337 Post to Van2Shout Chat Box...

Vanilla Forums Van2Shout Plugin 1.0.51 - CSRF Vulnerabilities

Exploit for php platform in category web applications...

Vanilla Forums Van2Shout Plugin 1.0.51 - Multiple Cross-Site Request Forgery Vulnerabilities

Exploit Title: Vanilla Forums where 1337 is the id. Bookmark CSRF: http://site.org/index.php=/vanilla/discussion/bookmark/1337 UnBookmark CSRF http://site.org/index.php=/vanilla/discussion/bookmark/1337? Delete Message CSRF http://site.org/index.php=/messages/clear/1337 Post to Van2Shout Chat Box...

Vanilla Forums Van2Shout Plugin 1.0.51 - Multiple Cross-Site Request Forgery Vulnerabilities

Vanilla Forums Van2Shout Plugin 1.0.51 - Multiple Cross-Site Request Forgery Vulnerabilities Exploit Title: Vanilla Forums where 1337 is the id. Bookmark CSRF: http://site.org/index.php=/vanilla/discussion/bookmark/1337 UnBookmark CSRF http://site.org/index.php=/vanilla/discussion/bookmark/1337?...

Vanilla Forums 2.0.18.4 SQL Injection

Product Name: Vanilla Forums Vulnerable Version: Up to vanilla-core-2-0-18-4 Tested on: Windows Server 2003 Apache 2.4.3 PHP 5.4.7 MySQL 5.5.27 Vulnerability Overview: SQL-Injection is possible, because$POST arrays are not proper sanitized. You do not need to be authenticated. Vulnerability...

Vanilla Forums 2-0-18-4 - SQL-Injection Vulnerability

SQL-Injection is possible, because$POST arrays are not proper sanitized. You do not need to be authenticated. To insert an arbitrary user, a sample HTTP-Post Request looks as follows: POST /PATH/vanilla/entry/signin HTTP/1.1 Host: HOST User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64; rv:19.0...

Vanilla Forums 2-0-18-4 - SQL Injection

Vanilla Forums 2-0-18-4 - SQL Injection Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable Date: 04/05/2013 Exploit Author: bl4ckw0rm Vendor Homepage: http://vanillaforums.org/ Version: 2-0-18-4 Tested on: Windows Product Name: Vanilla Forums Vulnerable Version...

Vanilla Forums 2-0-18-4 - SQL Injection

Exploit Title: Vanilla Forums - SQL-Injection - Insert arbitrary user & dump usertable Date: 04/05/2013 Exploit Author: bl4ckw0rm Vendor Homepage: http://vanillaforums.org/ Version: 2-0-18-4 Tested on: Windows Product Name: Vanilla Forums Vulnerable Version: Up to vanilla-core-2-0-18-4 Tested on:...