Cross site scripting

Cross-site scripting XSS vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two certain fields in a contentsnew operation in the adcontents section...

CVE-2007-0191

CVE-2007-0191 describes a Cross-site Scripting (XSS) vulnerability in MKPortal, specifically in admin.php during a contents_new operation in the ad_contents section. The issue arises from two fields used in that operation, allowing remote attackers to inject arbitrary script/HTML. Available refer...

CVE-2007-0194

The CVE-2007-0194 entry concerns MKPortal M1.1 RC1. An attacker can remote‑access admin.php and trigger MK_PATH=1 to cause an error message that reveals internal path information, exposing sensitive data (confidentiality impact). The vulnerability is rooted in an information disclosure flaw in MK...

CVE-2007-0192

The CVE-2007-0192 CSRF vulnerability affects MKPortal’s admin.php in the save_main operation (ad_perms) where an attacker can induce privilege changes. The issue is exposed via a crafted getURL in a .swf loaded in an IFRAME, enabling remote modification of privilege settings (All Guests are Admin...

CVE-2007-0191

Cross-site scripting XSS vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two certain fields in a contentsnew operation in the adcontents section...

CVE-2007-0194

admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MKPATH=1 query string, which reveals the path in an error message...

CVE-2007-0192

Cross-site request forgery CSRF vulnerability in the savemain operation in the adperms section in admin.php in MKPortal allows remote attackers to modify privilege settings, as demonstrated using a getURL of admin.php within a .swf file contained in an IFRAME element, aka the "All Guests are Admi...

CVE-2007-0192: Undefined Security Weakness

Cross-site request forgery CSRF vulnerability in the savemain operation in the adperms section in admin.php in MKPortal allows remote attackers to modify privilege settings, as demonstrated using a getURL of admin.php within a .swf file contained in an IFRAME element, aka the "All Guests are Admi...

CVE-2007-0191: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admin.php in MKPortal allows remote attackers to inject arbitrary web script or HTML via two certain fields in a contentsnew operation in the adcontents section...

CVE-2007-0194: Undefined Security Weakness

admin.php in MKPortal M1.1 RC1 allows remote attackers to obtain sensitive information via a direct request with an MKPATH=1 query string, which reveals the path in an error message...

MKPortal Full Path Disclosure

MkPortal Full Path Disclosure Vulnerability discovered by: Demential Web: http://headburn.altervista.org E-mail: infoatburnheaddotit Mkportal website: http://www.mkportal.it Tested on MKPortal M1.1 RC1 with PhpBB other versions may also be affected. http://www.victim.com/mkportal/admin.php?MKPATH...

MkPortal Admin XSS

MkPortal Admin XSS Discovered by: Demential Web: http://headburn.altervista.org E-mail: infoatburnheaddotit Mkportal website: http://www.mkportal.it Go to: /mkportal/admin.php?ind=adcontents&op=contentsnew In both fields write: "scriptalertdocument.cookie/script and press save. Alert will appear...

mkportalfun.txt

MkPortal "All Guests are Admin" Exploit Vulnerability discovered and exploited by: Demential Web: http://headburn.altervista.org E-mail: infoatburnheaddotit Mkportal website: http://www.mkportal.it Start Macromedia Flash and create an swf file with this code: var idg:Number = 9; var p13:Number = ...

MkPortal "All Guests are Admin" Exploit

MkPortal "All Guests are Admin" Exploit Vulnerability discovered and exploited by: Demential Web: http://headburn.altervista.org E-mail: infoatburnheaddotit Mkportal website: http://www.mkportal.it Start Macromedia Flash and create an swf file with this code: var idg:Number = 9; var p13:Number = ...

CVE-2006-6741

Cross-site request forgery CSRF vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a delete operation in an img BBcode tag...

CVE-2006-6741

Cross-site request forgery CSRF vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a delete operation in an img BBcode tag...

CVE-2006-6741

CVE-2006-6741 concerns a CSRF vulnerability in the urlobox component of MKPortal. The issue allows remote attackers to delete arbitrary administrator messages by triggering a delete operation embedded in an img BBcode tag. Affected software is MKPortal (specifically the urlobox feature); underlyi...

CVE-2006-6741: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a delete operation in an img BBcode tag...

MKPortal M1.1.1 - Urlobox Cross-Site Request Forgery

MKPortal M1.1.1 - Urlobox Cross-Site Request Forgery MkPortal Urlobox Cross Site Request Forgery Discovered by: Demential Web: http://www.burnhead.it E-mail: [email protected] Mkportal website: http://www.mkportal.it posting img?ind=urlobox&op=delete&idurlo=X/img in MkPortal urlobox where X is an ...

MKPortal M1.1.1 (Urlobox) Cross Site Request Forgery Vulnerability

Exploit for unknown platform in category web applications ================================================================== MKPortal M1.1.1 Urlobox Cross Site Request Forgery Vulnerability ================================================================== MkPortal Urlobox Cross Site Request...