CVE-2012-4279

Free Realty 3.1-0.6 contains SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the view parameter in agentdisplay.php or the edit parameter in admin/admin.php. The issue is described across multiple sources as consistent with unparameterized input lea...

CVE-2012-4280

Multiple cross-site request forgery CSRF vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that 1 add an agent via an addagent action or 2 modify an agent...

CVE-2012-4278: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 notes parameter to a admin/agenteditor.php; 2 title, 3 previewdesc, 4 fulldesc, or 5 notes parameter b to agentadmin.php or c in an addlisting action to...

PT-2012-5307

Name of the Vulnerable Software and Affected Versions Free Realty versions 3.1-0.6 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the view parameter to "agentdisplay.php" or the edit parameter to "admin/admin.php". Recommendations For Fre...

CVE-2012-4279: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...

CVE-2012-4280: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in admin/agenteditor.php in Free Realty 3.1-0.6 allow remote attackers to hijack the authentication of administrators for requests that 1 add an agent via an addagent action or 2 modify an agent...

PT-2012-5306

Name of the Vulnerable Software and Affected Versions Free Realty versions 3.1-0.6 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via several parameters, including notes to...

PT-2012-5308

Name of the Vulnerable Software and Affected Versions Free Realty versions 3.1-0.6 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests, including...

Free Realty 3.1-0.6 - Multiple Vulnerabilities

Free Realty 3.1-0.6 - Multiple Vulnerabilities Title: ====== Free Reality v3.1-0.6 - Multiple Web Vulnerabilities Date: ===== 2012-05-07 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=513 VL-ID: ===== 513 Common Vulnerability Scoring System:...

CVE-2010-1708

Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the 1 login field aka agentname parameter or 2 password field aka agentpassword parameter...

Sql injection

Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the 1 login field aka agentname parameter or 2 password field aka agentpassword parameter...

CVE-2010-1708

Affected software: Free Realty, via agentadmin.php. Vulnerability: multiple SQL injection flaws that allow remote attackers to execute arbitrary SQL commands by supplying crafted values in the login field (agentname) or the password field (agentpassword). Impact: data exposure and manipulation co...

CVE-2010-1708

Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the 1 login field aka agentname parameter or 2 password field aka agentpassword parameter...

CVE-2010-1708: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in agentadmin.php in Free Realty allow remote attackers to execute arbitrary SQL commands via the 1 login field aka agentname parameter or 2 password field aka agentpassword parameter...

FreeRealty SQL Injection

Exploit Title: Authentication bypass in FreeRealtyFree Real Estate Listing Software Date: 27-apr-2010 Author: Sid3^effects Software Link: N/a CVE : Code : Authentication bypass in FreeRealty Vendor:http://freerealty.rwcinc.net/ Author:Sid3^effects Description : Free Realty is primarily designed f...

CVE-2006-3165

SQL injection vulnerability in propview.php in Free Realty 2.9-0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter...

CVE-2006-3167

Free Realty before 2.9 allows remote attackers to obtain the full path and other sensitive information via unspecified manipulations that produce an error message...

CVE-2006-3166

Cross-site scripting XSS vulnerability in propview.php in Free Realty 2.9-0.6 and earlier allows remote attackers to execute arbitrary web script or HTML via the sort parameter...

CVE-2006-3165

SQL injection vulnerability in propview.php in Free Realty 2.9-0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the sort parameter...

CVE-2006-3167

Free Realty before 2.9 allows remote attackers to obtain the full path and other sensitive information via unspecified manipulations that produce an error message...