3819 matches found
CVE-2006-0157
settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and adminpassword parameters, then declares the new password string in the newpasswd and confirmpasswd paramete...
CVE-2006-0157
The connected documents confirm a concrete vulnerability in Reamday Enterprises Magic News Plus 1.0.3: settings.php contains a flaw that lets remote attackers change the administrator password. The attack is performed via a change action that supplies identical values for passwd and admin_passwor...
CVE-2006-0157
settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and adminpassword parameters, then declares the new password string in the newpasswd and confirmpasswd paramete...
Magic News Plus <= 1.0.3 Admin Pass Change Exploit
Exploit for unknown platform in category web applications ================================================== Magic News Plus All rights reserved. An input validation flaw exists within 'settings.php' of Magic News Plus which can lead to the changing of the administrative password. Here is where t...
Magic News Plus 1.0.3 - Admin Pass Change
!/usr/bin/perl Magic News Plus All rights reserved. An input validation flaw exists within 'settings.php' of Magic News Plus which can lead to the changing of the administrative password. Here is where the problem is line 108 of 426: ... 1 elseif $action == "change" ... 2 if $passwd !=...
phpBB <= 2.0.17 (signature_bbcode_uid) Remote Command Exploit
No description provided by source. !/usr/bin/perl phpBB = 2.0.17 remote command execution exploit need for work: 1. PHP 5 5.0.5 2. registerglobals=On 3. magicquotes off ------------------------------------------------ coded by 1dt.w0lf RST/GHC http://rst.void.ru http://ghc.ru 03.11.05 use...
PHPGedView <= 3.3.7 remote code execution
--- PHPGedView = 3.3.7 Arbitrary local/remote code execution & php injection --- software: site: http://www.phpgedview.net/ description: "PhpGedView is a revolutionary genealogy program which allows you to view and edit your genealogy on your website." - vulnerabilties:...
From PHP Forum the vulnerability of the endoscope security management-vulnerability warning-the black bar safety net
From: ReJeCt‘s Blog Blue magic Forum is a PHP Forum in the country is widely used. Due to its user registration module in some code defect that can lead to a malicious attacker will be normal users to elevate to administrator. First let's look at an invasion of the examples. The invasion paradigm...
Limbo <= 1.0.4.2 _SERVER[REMOTE_ADDR] Overwrite Remote Exploit
Exploit for unknown platform in category web applications ============================================================== Limbo this works wtih registerglobals off & regardless of magicquotesgpc settings usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "Humble words and...
CVE-2005-4177
Cross-site scripting XSS vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter...
CVE-2005-4177
The CVE-2005-4177 entry concerns an XSS vulnerability in Magic Book Personal and Professional 2.0, specifically in the book.cfm component where the StartRow parameter is not properly sanitized. The vulnerability could allow remote attackers to inject arbitrary web script or HTML, as documented by...
CVE-2005-4177
Cross-site scripting XSS vulnerability in book.cfm in Magic Book Personal and Professional 2.0 allows remote attackers to inject arbitrary web script or HTML via the StartRow parameter...
Magic Book Professional 2.0 - 'Book.cfm' Cross-Site Scripting
source: https://www.securityfocus.com/bid/15805/info Magic Book Professional is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in...
CVE-2005-4071
Multiple SQL injection vulnerabilities in CFMagic Magic Forum Personal 2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 ForumID parameter in viewforum.cfm, and 2 ForumID, 3 Thread, and 4 ThreadID parameters in viewthread.cfm...
CVE-2005-4072
Cross-site scripting XSS vulnerability in CFMagic Magic Forum Personal 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the Words parameter in searchforums.cfm, as used in the "Search For:" field...
CVE-2005-4071
CVE-2005-4071 affects CFMagic Magic Forum Personal 2.5 and earlier. The vulnerabilities are SQL injection in the web interface: (1) ForumID in view_forum.cfm and (2) ForumID, (3) Thread, and (4) ThreadID in view_thread.cfm, allowing remote attackers to execute arbitrary SQL commands. The NVD entr...
CVE-2005-4073
CVE-2005-4073 affects CFMagic Magic List Pro 2.5 with an SQL injection in view_archive.cfm via the ListID parameter, enabling remote execution of arbitrary SQL. CVSS v2 base score 7.5 (HIGH); attack vector NETWORK, low complexity, no authentication. No remediation details are provided in the conn...
CVE-2005-4072
Cross-site scripting XSS vulnerability in CFMagic Magic Forum Personal 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the Words parameter in searchforums.cfm, as used in the "Search For:" field...
CVE-2005-4072
The CVE describes a cross-site scripting (XSS) vulnerability in CFMagic Magic Forum Personal 2.5 and earlier, where an attacker can inject arbitrary script via the Words parameter in search_forums.cfm used in the “Search For:” field. The available records confirm the affected software and the inp...
Website Baker 2.6.0 - Authentication Bypass / Remote Code Execution
this works with magicquotesgpc off usage: launch from Apache, fill in requested fields, then go! Sun Tzu: "The control of a large force is the same principle as the control of a few men: it is merely a question of dividing up their numbers." errorreporting0; iniset"maxexecutiontime",0;...