SolpotCrew Advisory #5 - modernbill ver 1.6 (DIR) Remote File Inclusion

SolpotCrew Community modernbill ver 1.6 DIR Remote File Inclusion Download file : http://freshmeat.net/projects/modernbill/ Bug Found By :Solpot a.k.a k. Hasibuan 03-08-2006 contact: [email protected] Website : http://www.solpotcrew.org/adv/solpot-adv-04.txt Greetz: choi , cow1seng , Ibnusi...

Sql injection

Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the 1 id parameter in a user.php, or 2 where and 3 order parameters to b admin.php...

CVE-2006-1853

Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the 1 id parameter in a user.php, or 2 where and 3 order parameters to b admin.php...

CVE-2006-1853

Multiple SQL injection vulnerabilities in ModernBill 4.3.2 and earlier allow remote attackers or administrators to execute arbitrary SQL commands via the 1 id parameter in a user.php, or 2 where and 3 order parameters to b admin.php...

CVE-2006-1853

The CVE-2006-1853 entry concerns ModernBill 4.3.2 and earlier, which contain multiple SQL injection vulnerabilities. The affected components are (1) user.php via the id parameter and (2) admin.php via the where and order parameters, permitting remote attackers or administrators to execute arbitra...

ModernBill 4.3 - user.php SQL Injection

ModernBill 4.3 - user.php SQL Injection source: https://www.securityfocus.com/bid/17596/info ModernBill is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit coul...

ModernBill 4.3 - 'user.php' SQL Injection

source: https://www.securityfocus.com/bid/17596/info ModernBill is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

ModernBill multiple SQL inj. vuln.

ModernBill multiple SQL inj. vuln. Vuln. discovered by : r0t Date: 18 april 2006 vendor:www.moderngigabyte.com product link: www.moderngigabyte.net/modernbill/index.htm?ref=homeofmodernbill affected versions:4.3.2 and previous orginal advisory:...

CVE-2005-1054

PHP remote file inclusion vulnerability in news.php in ModernBill 4.3.0 and earlier allows remote attackers to execute arbitrary PHP code by modifying the DIR parameter to reference a URL on a remote web server that contains the code...

CVE-2005-1053

Multiple cross-site scripting XSS vulnerabilities in orderwiz.php in ModernBill 4.3.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 ccode or 2 aid parameters...

modernBill.txt

GulfTech Security Research April 10th, 2005 Vendor : ModernGigabyte, LLC URL : http://www.modernbill.com/ Version : ModernBill 4.3.0 && Earlier Risk : Multiple Vulnerabilities Description: ModernBill is a widely used billing and management software used by webhosts to manage billing and financial...

CVE-2005-1054

PHP remote file inclusion vulnerability in news.php in ModernBill 4.3.0 and earlier allows remote attackers to execute arbitrary PHP code by modifying the DIR parameter to reference a URL on a remote web server that contains the code...

CVE-2005-1053

Multiple cross-site scripting XSS vulnerabilities in orderwiz.php in ModernBill 4.3.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 ccode or 2 aid parameters...

CVE-2005-1054

CVE-2005-1054 affects ModernBill prior to or including 4.3.0, allowing remote PHP code execution via a PHP remote file include through the DIR parameter in news.php when DIR is set to a URL. This is echoed by later related CVEs (e.g., CVE-2008-5060) describing similar PHP RFI vulnerabilities in M...

CVE-2005-1053

CVE-2005-1053 affects ModernBill 4.3.0 and earlier. Vulnerable component: orderwiz.php; exploitation via parameters (c_code or aid) allows remote attackers to inject arbitrary web script/HTML (XSS). The consolidated sources describe XSS risk in the affected script and parameter vectors; no specif...

ModernGigabyte ModernBill 4.3 - Aid Cross-Site Scripting

ModernGigabyte ModernBill 4.3 - Aid Cross-Site Scripting source: https://www.securityfocus.com/bid/13089/info ModernBill is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'aid' parameter. This may...

ModernGigabyte ModernBill 4.3 - C_CODE Cross-Site Scripting

ModernGigabyte ModernBill 4.3 - CCODE Cross-Site Scripting source: https://www.securityfocus.com/bid/13087/info ModernBill is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'ccode' parameter. This...

ModernBill < 4.3.3 Multiple Vulnerabilities

Binary data 2812.prm...

ModernGigabyte ModernBill 4.3 - 'C_CODE' Cross-Site Scripting

source: https://www.securityfocus.com/bid/13087/info ModernBill is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'ccode' parameter. This may facilitate the theft of cookie-based authentication...

ModernGigabyte ModernBill 4.3 - 'Aid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/13089/info ModernBill is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'aid' parameter. This may facilitate the theft of cookie-based authentication...