408 matches found
Geeklog 1.6.0sr1 File Upload
============================================================================== Geeklog with the URL of the Geeklog site. Opens an interactive browser session where you can create directories and upload files. This also exposes all the files in the images/Library/File|Image|Media|Flash directories...
JVN#20478978 Site Calendar 'mycaljp' vulnerable to cross-site scripting
Site Calendar 'mycaljp' is a calendar plugin for Geeklog, which is an open source content management system. Site Calendar 'mycaljp' contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the late...
Geeklog <- 1.6.0sr1 - Remote Arbitrary File Upload
============================================================================== Geeklog = v1.6.0sr1 - Remote Arbitrary File Upload Software Site: http://www.geeklog.net Dork: "By Geeklog" "Created this page in" +seconds +powered inurl:publichtml...
[InterN0T] Geeklog 1.5 - Pre-Installation Vulnerabilities
Geeklog - Pre-Installation Vulnerabilities Version Affected: 1.5.2sr4 18th April 2009 newest Info: See website for more details. Opinion: The system seems to be more secure than most web application systems on the Internet these days. Credits: InterN0T External Links: http://www.geeklog.net/ -::...
Geeklog usersettings.php模块SQL注入漏洞
BUGTRAQ ID: 34553 Geeklog是一个免费的、开放源码的Web应用程序。它可以使用户创建一个虚拟的社区，可以管理用户，张贴文章等。Geeklog采用PHP实现，以MySQL为后台数据库。 Geeklog的usersettings.php文件中的1467 - 1480行中存在SQL注入漏洞： ... if isset $USER'uid' && $USER'uid' 1 switch $mode case 'saveuser': savepreferences $POST; $display .= saveuser$POST; PLGprofileExtrasSave ;...
Geeklog <= 1.5.2 savepreferences()/*blocks[] remote sql injection exploit
?php / Geeklog = 1.5.2 savepreferences/blocks remote sql injection exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ software site: http://www.geeklog.net/ PHP and MySQL version independent vulnerability, see usersettings.php near lines 1467 - 1480: ... if isset...
Geeklog <= 1.5.2 savepreferences()/*blocks[] SQL Injection Exploit
No description provided by source. ?php / Geeklog = 1.5.2 savepreferences/blocks remote sql injection exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ software site: http://www.geeklog.net/ PHP and MySQL version independent vulnerability, see usersettings.php nea...
Geeklog 1.5.2 SQL Injection
1 switch $mode case 'saveuser': savepreferences $POST; $display .= saveuser$POST; PLGprofileExtrasSave ; break; case 'savepreferences': savepreferences $POST; $display .= COMrefresh $CONF'siteurl' . '/usersettings.php?mode=preferences&msg=6'; break; ... all the $POST variables are passed to the...
Geeklog <= 1.5.2 savepreferences()/*blocks[] SQL Injection Exploit
Exploit for unknown platform in category web applications ================================================================== Geeklog 1 switch $mode case 'saveuser': savepreferences $POST; $display .= saveuser$POST; PLGprofileExtrasSave ; break; case 'savepreferences': savepreferences $POST;...
Geeklog 1.5.2 - savepreferences()*blocks[] SQL Injection
Geeklog 1.5.2 - savepreferencesblocks SQL Injection 1 switch $mode case 'saveuser': savepreferences $POST; $display .= saveuser$POST; PLGprofileExtrasSave ; break; case 'savepreferences': savepreferences $POST; $display .= COMrefresh $CONF'siteurl' . '/usersettings.php?mode=preferences&msg=6';...
Geeklog 1.5.2 - 'usersettings.php' SQL Injection
source: https://www.securityfocus.com/bid/34553/info Geeklog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data,...
Geeklog 1.5.2 - usersettings.php SQL Injection
Geeklog 1.5.2 - usersettings.php SQL Injection source: https://www.securityfocus.com/bid/34553/info Geeklog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...
Geeklog 1.5.2 - 'savepreferences()/*blocks[]' SQL Injection
1 switch $mode case 'saveuser': savepreferences $POST; $display .= saveuser$POST; PLGprofileExtrasSave ; break; case 'savepreferences': savepreferences $POST; $display .= COMrefresh $CONF'siteurl' . '/usersettings.php?mode=preferences&msg=6'; break; ... all the $POST variables are passed to the...
Geeklog Detection
The remote host is running Geeklog, an open source blog engine / content management system written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid36143; scriptversion"1.15"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/10/12";...
Geeklog <= 1.5.2 SEC_authenticate() SQL Injection Exploit
No description provided by source. ?php / Geeklog =1.5.2 SECauthenticate/PHPAUTHUSER sql injection exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ software site: http://www.geeklog.net/ credit goes to rgod, bug found more than a year ago working against PHP = 5....
Geeklog SEC_authenticate Function SQL Injection
The version of Geeklog installed on the remote host fails to sanitize input to the 'username' argument of the 'SECauthenticate' function in '/system/lib-security.php' before using it to construct database queries. Regardless of PHP's 'magicquotesgpc' setting, an unauthenticated attacker can explo...
Geeklog SEC_authenticate()函数SQL注入漏洞
BUGTRAQ ID: 34456 Geeklog是一个免费的、开放源码的Web应用程序。它可以使用户创建一个虚拟的社区，可以管理用户，张贴文章等。Geeklog采用PHP实现，以MySQL为后台数据库。 Geeklog的index.php模块中的SECauthenticate函数没有正确的验证用户所提交的PHPAUTHUSER和 REMOTEUSER变量参数，远程攻击者可以通过提交恶意查询请求执行SQL注入攻击。以下是/publichtml/webservices /atom/index.php文件中34-53行的有漏洞代码段： ... requireonce...
Geeklog <=1.5.2 'SESS_updateSessionTime()' vulnerability
As the vendor stated, see: http://www.geeklog.net/article.php/geeklog-1.5.2sr2 geeklog is also vulnerable to this: http://www.securityfocus.com/bid/34361/info actually this should be renamed in glFusion 'SESSupdateSessionTime' SQL Injection Vulnerability...
Geeklog <=1.5.2 SEC_authenticate()/PHP_AUTH_USER sql injection exploit
?php / Geeklog =1.5.2 SECauthenticate/PHPAUTHUSER sql injection exploit by Nine:Situations:Group::bookoo our site: http://retrogod.altervista.org/ software site: http://www.geeklog.net/ credit goes to rgod, bug found more than a year ago working against PHP = 5.0 google dorks: "By Geeklog" "Creat...
Geeklog 1.5.2 SQL Injection
= 5.0 google dorks: "By Geeklog" "Created this page in" +seconds +powered "By Geeklog" "Created this page in" +seconds +powered inurl:publichtml vulnerability, see /publichtml/webservices/atom/index.php near lines 34-53: ... requireonce '../../lib-common.php'; if PHPVERSION 5...