MD News 1 Version - Remote File Include Vulnerabilities

SaVSaK.CoM | SpC-x - The-BeKiR | MD News 1 Version - Remote File Include Vulnerabilities Risk : High Class: Remote Script : MD News Credits : SpC-x Thanks : The-BeKiR - Ejder - FasTBoY - ERNE - RMx Code : $configfile = "config.php"; require $configfile; Vulnerable : http://www.victim.com/MD...

[eVuln] MD News Authentication Bypass and SQL Injection Vulnerabilities

New eVuln Advisory: MD News Authentication Bypass and SQL Injection Vulnerabilities http://evuln.com/vulns/120/summary.html --------------------Summary---------------- eVuln ID: EV0120 Software: MD News Sowtware's Web Site: http://www.matthewdingley.co.uk/ Versions: 1 Critical Level: Moderate Typ...

Sql injection

SQL injection vulnerability in admin.php in MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Authentication flaw

MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area...

CVE-2006-1756

MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area...

CVE-2006-1755

SQL injection vulnerability in admin.php in MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-1755

MD News 1 admin.php is affected by an SQL injection in the id parameter that allows remote attackers to run arbitrary SQL. Root cause: improper handling of input leading to SQL injection. Impact: potential unauthorized data exposure or modification; exploitation is remote over the network with lo...

CVE-2006-1755

SQL injection vulnerability in admin.php in MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-1756

MD News 1 is affected by CVE-2006-1756: remote attackers can bypass authentication via a direct request to a script in the Administration Area. The vulnerability enables auth bypass, with CVSS v2.0 base metrics: 7.5 (HIGH) with Network attack vector, Low complexity, no user interaction. Impact de...

CVE-2006-1756

MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area...

CVE-2006-1755: Undefined Security Weakness

SQL injection vulnerability in admin.php in MD News 1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-1756: Undefined Security Weakness

MD News 1 allows remote attackers to bypass authentication via a direct request to a script in the Administration Area...

[SA19563] MAXdev MD-Pro ADOdb "server.php" Insecure Test Script Security Issue

TITLE: MAXdev MD-Pro ADOdb "server.php" Insecure Test Script Security Issue SECUNIA ADVISORY ID: SA19563 VERIFY ADVISORY: http://secunia.com/advisories/19563/ CRITICAL: Moderately critical IMPACT: Security Bypass, System access WHERE: From remote SOFTWARE: MAXdev MD-Pro 1.x...

CVE-2006-1676

MAXdev MDPro MD-Pro

[SA19578] MAXdev MD-Pro "topicid" SQL Injection Vulnerability

TITLE: MAXdev MD-Pro "topicid" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19578 VERIFY ADVISORY: http://secunia.com/advisories/19578/ CRITICAL: Moderately critical IMPACT: Manipulation of data, Exposure of system information WHERE: From remote SOFTWARE: MAXdev MD-Pro 1.x...

MD News 1 - admin.php SQL Injection

MD News 1 - admin.php SQL Injection source: https://www.securityfocus.com/bid/17394/info MD News is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow...

MD News 1 - 'admin.php' SQL Injection

source: https://www.securityfocus.com/bid/17394/info MD News is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Design/Logic Flaw

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...

CVE-2006-0147

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...

CVE-2006-0147

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...