Sql injection

SQL injection vulnerability in index.php in PHP Inventory 1.2 allows remote authenticated users to execute arbitrary SQL commands via the supid parameter in a suppliers details action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...

CVE-2009-4597

The CVE-2009-4597 entry covers SQL injection flaws in PHP Inventory (notably versions around 1.2/1.3.x) in index.php. The vulnerabilities allow SQL commands to be injected through user_id in a user details action, and through user/password fields, enabling unauthorized data access via poorly sani...

CVE-2009-4599: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the JS Jobs comjsjobs component 1.0.5.6 for Joomla! allow remote attackers to execute arbitrary SQL commands via 1 the md parameter in an employer viewcompany action to index.php or 2 the oi parameter in an employer viewjob action to index.php...

CVE-2009-4596: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in PHP Inventory 1.2 allows remote attackers to inject arbitrary web script or HTML via the supid parameter in a suppliers details action...

CVE-2009-4595: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in PHP Inventory 1.2 allows remote authenticated users to execute arbitrary SQL commands via the supid parameter in a suppliers details action. NOTE: the provenance of this information is unknown; the details are obtained solely from third party informatio...

CVE-2009-4597: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in PHP Inventory 1.2 allow 1 remote authenticated users to execute arbitrary SQL commands via the userid parameter in a users details action, and allow remote attackers to execute arbitrary SQL commands via the 2 user username and 3 pass passwor...

CMScontrol 7.x File Upload

Exploit for unknown platform in category web applications ========================== CMScontrol 7.x File Upload ========================== CMScontrol 7.x File Upload Author : Cyber945 Bug Type : File Upload Infection : Adminin bilgileri alinabilir. Dork : inurl:"index.php?idmenu="...

MyBB 1.4 admin remote code execution vulnerability

在index.php文件336行左右代码如下： //index.php,336行左右 $plugins-runhooks"indexend"; //出现了eval函数，注意参数 eval"$index = "".$templates-get"index"."";"; outputpage$index; /code 看以下eval函数中的内容是否可以控制，继续找到templates类查看get函数的定义 code //inc/classtemplates.php,65行左右 function get$title, $eslashes=1, $htmlcomments=1 global...

phpwind 7.5 apps/groups/index.php远程包含漏洞

apps/groups/index.php 里$route和$basePath变量没有初始化,导致远程包含或者本地包含php文件,导致执行任意php代码 ?php if $route == "groups" requireonce $basePath . '/action/mgroups.php'; elseif $route == "group" requireonce $basePath . '/action/mgroup.php'; elseif $route == "galbum" requireonce $basePath . '/action/mgalbum.php';...

Sql injection

SQL injection vulnerability in the MDForum module 2.x through 2.07 for MAXdev MDPro allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php...

Sql injection

SQL injection vulnerability in the BeeHeard combeeheard component 1.x for Joomla! allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a suggestions action to index.php...

Sql injection

SQL injection vulnerability in the JoomlaBamboo JB Simpla Admin template for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an article action to the comcontent component, reachable through index.php. NOTE: the vendor disputes this report, saying:...

CVE-2010-0158

CVE-2010-0158 describes a SQL injection risk in the JoomlaBamboo (JB) Simpla Admin template for Joomla! via the id parameter in an article action to the com_content component (accessible through index.php). The issue is asserted by multiple sources to allow remote SQL command execution, with a ve...

CVE-2009-4576: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the BeeHeard combeeheard component 1.x for Joomla! allows remote attackers to execute arbitrary SQL commands via the categoryid parameter in a suggestions action to index.php...

CVE-2009-4578: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Facileforms comfacileforms component for Joomla! and Mambo allows remote attackers to inject arbitrary web script or HTML via the Itemid parameter to index.php...

CVE-2009-4577: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the MDForum module 2.x through 2.07 for MAXdev MDPro allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php...

Vulnerabilities in Athree CMS

====================================================================== Secunia Research 29/12/2009 - AproxEngine Multiple Vulnerabilities - ====================================================================== Table of Contents Affected Software......................................................

CVE-2009-4571: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in PhpShop 0.8.1 allow remote attackers to execute arbitrary SQL commands via the 1 moduleid parameter in an admin/functionlist action, the 2 vendorid parameter in a vendor/vendorform action, the 3 moduleid parameter in an admin/moduleform actio...

CVE-2009-4564

SQL injection vulnerability in index.php in Zenphoto 1.2.5, when the ZenPage plugin is enabled, allows remote attackers to execute arbitrary SQL commands via the category parameter, related to a URI under news/category/...

CVE-2009-4561

Multiple SQL injection vulnerabilities in Admin/index.php in WebLeague 2.2.0, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...