SoftBB 0.1 (cmd) Remote Command Execution Exploit

Exploit for unknown platform in category web applications ================================================= SoftBB 0.1 cmd Remote Command Execution Exploit ================================================= !/usr/bin/perl Affected.scr..: SoftBB 0.1 Poc.ID........: 11060904 Type..........: PHP code...

SoftBB 0.1 (cmd) Remote Command Execution Exploit

No description provided by source. !/usr/bin/perl Affected.scr..: SoftBB 0.1 Poc.ID........: 11060904 Type..........: PHP code execution, SQL Injection, Full Path Disclosure Risk.level....: High Vendor.Status.: Unpatched Src.download..: softbb.be Poc.link......: acid-root.new.fr/poc/11060904.txt...

SoftBB 0.1 - 'cmd' Remote Command Execution

!/usr/bin/perl Affected.scr..: SoftBB 0.1 Poc.ID........: 11060904 Type..........: PHP code execution, SQL Injection, Full Path Disclosure Risk.level....: High Vendor.Status.: Unpatched Src.download..: softbb.be Poc.link......: acid-root.new.fr/poc/11060904.txt Advisory.link.:...

Full Path Disclosure xGuestBook v1.02

Dicomdk Full Path Disclosure xGuestBook v1.02 http://xatrix.xa.funpic.de/xguestbook2/ By : X-boy http://HOST/post.php Test : http://xatrix.xa.funpic.de/xguestbook2/post.php Result : ======== Notice: Undefined index: user in sitepost.php on line 15 Notice: Undefined index: mail in sitepost.php on...

DotClear : Multiples Full Path Disclosure

DotClear : Multiples Full Path Disclosure Discovred By Silitix - Silitixgmailcom www.Silitix.com A remote user can access the files directly to cause the system to display an error message that indicates the full path of the server. /ecrire/tools/blogroll/editcat.php...

WordPress <= 2.0.3 - Full Path Disclosure

Because of this vulnerabilitity, attackers can obtain the installation path via a direct request to various files for the example, wp-includes directories, wp-content, and wp-admin. Solution Update the WordPress to the latest available version at least 2.0.4...

WordPress 2.0.3 SQL Error and Full Path Disclosure

WordPress 2.0.3 SQL Error and Full Path Disclosure Discovered By zero Moroccan Security Team Software: WordPress 2.0.3 Site : www.wordpress.org SQL Error Example: http://localhost/wordpress/index.php?paged=-1 Result: WordPress database error: Erreur de syntaxe pr?s de '-20, 10' ? la ligne 1 SELEC...

Buddy Zone Version 1.0.1 - XSS

Buddy Zone Version 1.0.1 Homepage: http://www.vastal.com/buddy-zone-social-networking-script.html Affected files: Sending invitations Profiles Blogs Journals Posting comments Posting in the forum Sending mail Creating a group viewsubforum.php viewpost.php viewclassifieds.php viewad.php...

phpBB 2.0.21 Full Path Disclosure

------------------------------------------------------------------- phpBB 2.0.21 Full Path Disclosure ------------------------------------------------------------------- Discovered By zero Moroccan Security Team ------------------------------------------------------------------- Details Software:...

News52.txt

!/usr/bin/perl VulnScr: News version 5.2 and prior E-mail: [email protected] Web: www.vincent-leclercq.com Date: Thu June 29 12:01 2006 Credits: DarkFig [email protected] Vuln: XSS, Full Path Disclosure, SQL Injection Advisorie: http://www.acid-root.new.fr/advisories/news52.txt frenc...

buddyzone101.txt

Buddy Zone Version 1.0.1 Homepage: http://www.vastal.com/buddy-zone-social-networking-script.html Affected files: Sending invitations Profiles Blogs Journals Posting comments Posting in the forum Sending mail Creating a group viewsubforum.php viewpost.php viewclassifieds.php viewad.php...

Zen-Cart 1.3.0.2 Full Path Disclosure

Zen-Cart 1.3.0.2 En: Zen-Cart .. E-commerce PHP Program - This Bug Can Tell U Where The Program @ Server Ar: .. Full Path Disclosure :- /index.php?GET= /index.php?SESSION= /index.php?POST= /index.php?COOKIE= /index.php?SESSION= /------------------------------------------/...

v3chatIM.txt

V3 Chat Instant Messenger http://www.v3chat.com/ Affected files: /mail/index.php /mail/reply.php isonline.php online.php profile.php profileview.php search.php mycontacts.php expire.php Editing your profile: - input boxes ------------------------------------------ Mail Vulnerabilities: Full path...

singaporeMultiple.txt

Produce : singapore gallery Versions : 0.10.0 and prior Site : http://www.sgal.org/ Discovred By : Moroccan Security Research Team Simo64 Greetz : CiM-Team - dabdoub - DarkbiteX - drackanz - Iss4m - Mourad - Rachid .:r00tkita - s4mi - Silitix - tahati - And All Friends : - Vulnerable code near...

singapore gallery &lt;= 0.10.0 Multiple Vulnerabilities

Produce : singapore gallery Versions : 0.10.0 and prior Site : http://www.sgal.org/ Discovred By : Moroccan Security Research Team Simo64 Greetz : CiM-Team - dabdoub - DarkbiteX - drackanz - Iss4m - Mourad - Rachid .:r00tkita - s4mi - Silitix - tahati - And All Friends : - Vulnerable code near...

MPCS v0.2 - XSS

MPCS v0.2 Homepage: http://tpvgames.co.uk/mpcs Affected files: comment.php XSS vuln with cookie & full path disclosure: Direct html injection doesnt seem to work, however, if you navigate to the code below in your browser, and then post a comment on the same page, our XSS example will occure...

PhpMyFactures 1.0 Cross Site Scripting, SQL Injection, Full Path Disclosure and others

PhpMyFactures 1.0 Full Path Disclosure Guest http://.../verif.php Guest http://.../inc/footer.php Guest http://.../remises/ajouterremise.php Informations modification Guest http://.../tva/ajoutertva.php?action=send&tva=DIGITS Guest...

mafiamoblog.txt

Produce : Mafia Moblog WebSite :http://mafia.pearlabs.org Version : 6 Full and Prior Discovred By :Moroccan Security Research Team Simo64 IMPACT : Manipulation of data, System access + Full Path Disclosure : The problem is that it is possible to disclose the full path to 'big.php','upgrade.php' b...

TinyMuw v1.0 - XSS

TinyMuw v1.0 Homepage: http://www.l0j1k.com/tinyMuw/index.php Effected files: quickchat.php input box videoPage.php Input isn't sanatized before being generated in the quickchat.php chatbox. For PoC try putting: IMG SRC=javascript:alert'XSS' in as your comment. Full path disclosure error via URL...

E-Dating System from scriptsez.net - XSS

E-Dating System Homepage: http://www.scriptsez.net/ Effected files: Input boxes. cindex.php Description: A Professional dating system that uses flatfiles instead of MySQL. XSS Vulnerabilities PoC: The input boxes of sending a message, and editing your profile do not properally filter user input...