phpcms2008-0day & phpcms 2 0 0 7 GBK version 0day injection scan script-vulnerability warning-the black bar safety net

Affected program: phpcms2008 gbk Vulnerability file: ask/searchajax.php code: ? php require './ include/common.inc.php'; requireonce MODROOT.'include/ask.class.php'; $ask = new ask; header'Content-type: text/html; charset=utf-8'; ifvia strtolowerCHARSET != 'utf-8' $q = iconvCHARSET, 'utf-8', $q;...

CVE-2010-4784

Multiple SQL injection vulnerabilities in member.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

Sql injection

Multiple SQL injection vulnerabilities in member.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

CVE-2010-4784: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in member.php in PHP Web Scripts Easy Banner Free 2009.05.18, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

CVE-2011-1060: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the member function in classes/member.php in WSN Guest 1.24 allows remote attackers to execute arbitrary SQL commands via the wsnuser cookie to index.php...

CVE-2010-4628

member.php in MyBB aka MyBulletinBoard before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service resource consumption by making requests to member.php that trigger scans of the entire users table...

CVE-2010-4522

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.4.14, and 1.6.x before 1.6.1, allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 editpost.php, 2 member.php, and 3 newreply.php...

CVE-2010-4628

member.php in MyBB aka MyBulletinBoard before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service resource consumption by making requests to member.php that trigger scans of the entire users table...

CVE-2010-4522

MyBB versions 1.4.14 and 1.6.x before 1.6.1 contain multiple XSS vulnerabilities that allow remote attackers to inject arbitrary script/HTML via editpost.php, member.php, and newreply.php. Root cause is improper input handling in those endpoints leading to stored/reflected input being executed in...

CVE-2010-4628: Undefined Security Weakness

member.php in MyBB aka MyBulletinBoard before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service resource consumption by making requests to member.php that trigger scans of the entire users table...

CVE-2010-4522: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.4.14, and 1.6.x before 1.6.1, allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 editpost.php, 2 member.php, and 3 newreply.php...

MyPHP Forum SQL injection vulnerability-vulnerability warning-the black bar safety net

Affected system: MyPHP. ws MyPHP Forum v3. 0 Final Description: BUGTRAQ ID: 2 7 1 1 8 MyPHP Forum is an easy to erect and easy to use based on MySQL with PHP Forum. MyPHP Forum process user requests data when there is an input validation vulnerability, a remote attacker could exploit this...

Oxygen2PHP 1.1.3 - 'member.php' SQL Injection

!/usr/bin/perl 0-Day Oxygen2PHP 'Mozilla/5.0', maxredirect = 0, cookiejar = $Cookies, or die $!; my $Get = $UserAgent-get$HostName.SQLInjection$UserName; if$Get-content = /0-91,5 : a-zA-Z0-9-.2,15 : a-f0-932/i refresh$HostName, $1, $2, $3; print " Exploit Successfully Executed \n"; print "...

phpcms 2 0 0 7 site management system Member. php page SQL injection vulnerability-vulnerability warning-the black bar safety net

Affected version: phpcms 2 0 0 7 GBK Vulnerability description: In the member/member. php line 4, The code is as follows: 1. .............. 2. $m = $db-getone SELECT FROM . TABLEMEMBER. m , . TABLEMEMBERINFO. i WHERE m. userid=i. userid AND m. username= 3. $username 4. , CACHE ,8 6 4 0 0; 5...

phpcms 2007网站管理系统Member.php页面SQL注入漏洞

在member/member.php的第4行，代码如下： 1. .............. 2. $m = $db-getone SELECT FROM .TABLEMEMBER. m , .TABLEMEMBERINFO. i WHERE m.userid=i.userid AND m.username= 3. $username 4. , CACHE ,86400; 5. .............. username变量未经过过滤就进入查询了，我们在其包含的include/common.inc.php文件中有如下代码： 1. ................ 2...

Phpkit 1.6.1 (member.php) Sql Injection Vulnerability

Exploit for unknown platform in category web applications ===================================================== Phpkit 1.6.1 member.php Sql Injection Vulnerability ===================================================== Phpkit 1.6.1 SQL Injection member.php | | ||| | | | | | -| .'| || | | | -| | | ...

CVE-2009-4448

inc/functionstime.php in MyBB aka MyBulletinBoard 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service CPU consumption via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors...

discuz 6.1.0 member.php 跨站脚本漏洞

No description provided by source...

CVE-2008-6957: Undefined Security Weakness

member.php in Crossday Discuz! Board allows remote attackers to reset passwords of arbitrary users via crafted 1 lostpasswd and 2 getpasswd actions, possibly involving predictable generation of the id parameter...

CVE-2009-2131: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted userhomepage parameter to member.php, and then posting a comment associated with a picture...