399 matches found
CVE-2014-9006
Monstra 3.0.1 and earlier are affected: the login flow uses a cookie (login_attempts) to count login attempts. The root cause is cookie-based tracking that can be bypassed by deleting the cookie or setting it to specific values, enabling brute-force login attempts. The PacketStorm writeup shows a...
CVE-2014-9006
Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the loginattempts cookie or setting it to certain values...
Monstra <= 3.0.1 Admin Bruteforce Limit Bypass
Monstra versions 3.0.1 and below keep a tally client side in a cookie to count login attempts, allowing an attacker to completely bypass their abuse functionality. admin/index.php :33-42 // Admin login if Request::post'loginsubmit' if Cookie::get'loginattempts' && Cookie::get'loginattempts' = 5...
Monstra 3.0.1 Bruteforce Mitigation Bypass
Monstra = 5 $loginerror = 'You are banned for 10 minutes. Try again later', 'users'; else $user = $users-select"login='" . trimRequest::post'login' . "'", null; The code blocks bruteforce attempts simply by placing a cookie called "loginattempts" in the victims browser an attacker can craft a...
Monstra <= 3.0.1 HTTP Response Splitting
Monstra versions 3.0.1 and below suffer from an HTTP response splitting vulnerability. Monstra = 3.0.1 HTTP Response Splitting /plugins/captcha/crypt/cryptographp.php SetCookie"cryptcookietest", "1"; Header"Location: cryptographp.inc.php?cfg=".$GET'cfg'."&sn=".sessionname."&".SID; so providing...
Monstra 3.0.1 HTTP Response Splitting
Monstra 5.1.2...
Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability
Title: ====== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability Date: ===== 2013-09-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1081 VL-ID: ===== 1081 Common Vulnerability Scoring System: ==================================== 8.7 Introduction: =============...
Monstra CMS 1.2.0 Blind SQL Injection
Title: ====== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability Date: ===== 2013-09-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1081 VL-ID: ===== 1081 Common Vulnerability Scoring System: ==================================== 8.7 Introduction: =============...
Monstra CMS 1.2.0 - login SQL Injection
Monstra CMS 1.2.0 - login SQL Injection source: https://www.securityfocus.com/bid/62572/info Monstra CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...
Monstra CMS 1.2.0 - 'login' SQL Injection
source: https://www.securityfocus.com/bid/62572/info Monstra CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...
Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability
Document Title: =============== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1081 Release Date: ============= 2013-09-19 Vulnerability Laboratory ID VL-ID: ==================================== 108...
Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability
Document Title: =============== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1081 Release Date: ============= 2013-09-19 Vulnerability Laboratory ID VL-ID: ==================================== 108...
Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities
Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities Monstra 1.2.1 Multiple HTML Injection Vulnerabilities alert1;' / alert2;' / input type="hidden" name="csrf" value="a7de775dce681ae31b7e89...
Monstra 1.2.1 Cross Site Scripting
Monstra 1.2.1 Multiple HTML Injection Vulnerabilities input type="hidden" name="menu...
Monstra 1.2.1 Multiple HTML Injection Vulnerabilities
Summary Monstra is fast and small content management system written in PHP! It's free, open source and easy to use from the start! Description Monstra suffers from multiple stored XSS vulnerabilities when parsing user input to the 'menuitemlink', 'menuitemname' and 'pagetitle' parameters via POST...
Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities
Monstra 1.2.1 Multiple HTML Injection Vulnerabilities alert1;' / alert2;' / input type="hidden" name="day" value="21"...
Monstra CMS 1.1.6 Cross Site Request Forgery
1=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 0 0 x Official Website: http://www.1337day.com 1 1 x...
Monstra - Version 1.1.6 Multiple CSRF Vulnerability
Exploit for php platform in category web applications 1=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1...
