499 matches found
CVE-2014-9006: Undefined Security Weakness
Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the loginattempts cookie or setting it to certain values...
PT-2014-8785
Name of the Vulnerable Software and Affected Versions Monstra versions 3.0.1 and earlier Description The issue allows remote attackers to conduct brute force login attacks. This is possible because Monstra uses a cookie to track the number of login attempts, and an attacker can manipulate this by...
Monstra <= 3.0.1 Admin Bruteforce Limit Bypass
Monstra versions 3.0.1 and below keep a tally client side in a cookie to count login attempts, allowing an attacker to completely bypass their abuse functionality. admin/index.php :33-42 // Admin login if Request::post'loginsubmit' if Cookie::get'loginattempts' && Cookie::get'loginattempts' = 5...
Monstra <= 3.0.1 HTTP Response Splitting
Monstra versions 3.0.1 and below suffer from an HTTP response splitting vulnerability. Monstra = 3.0.1 HTTP Response Splitting /plugins/captcha/crypt/cryptographp.php SetCookie"cryptcookietest", "1"; Header"Location: cryptographp.inc.php?cfg=".$GET'cfg'."&sn=".sessionname."&".SID; so providing...
Monstra 3.0.1 Bruteforce Mitigation Bypass
Monstra = 5 $loginerror = 'You are banned for 10 minutes. Try again later', 'users'; else $user = $users-select"login='" . trimRequest::post'login' . "'", null; The code blocks bruteforce attempts simply by placing a cookie called "loginattempts" in the victims browser an attacker can craft a...
Monstra 3.0.1 HTTP Response Splitting
Monstra 5.1.2...
Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability
Title: ====== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability Date: ===== 2013-09-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1081 VL-ID: ===== 1081 Common Vulnerability Scoring System: ==================================== 8.7 Introduction: =============...
Monstra CMS 1.2.0 Blind SQL Injection
Title: ====== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability Date: ===== 2013-09-20 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1081 VL-ID: ===== 1081 Common Vulnerability Scoring System: ==================================== 8.7 Introduction: =============...
Monstra CMS 1.2.0 - login SQL Injection
Monstra CMS 1.2.0 - login SQL Injection source: https://www.securityfocus.com/bid/62572/info Monstra CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...
Monstra CMS 1.2.0 - 'login' SQL Injection
source: https://www.securityfocus.com/bid/62572/info Monstra CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...
Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability
Document Title: =============== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1081 Release Date: ============= 2013-09-19 Vulnerability Laboratory ID VL-ID: ==================================== 108...
Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability
Document Title: =============== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1081 Release Date: ============= 2013-09-19 Vulnerability Laboratory ID VL-ID: ==================================== 108...
Monstra 1.2.1 Cross Site Scripting
Monstra 1.2.1 Multiple HTML Injection Vulnerabilities input type="hidden" name="menu...
Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities
Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities Monstra 1.2.1 Multiple HTML Injection Vulnerabilities alert1;' / alert2;' / input type="hidden" name="csrf" value="a7de775dce681ae31b7e89...
Monstra 1.2.1 Multiple HTML Injection Vulnerabilities
Summary Monstra is fast and small content management system written in PHP! It's free, open source and easy to use from the start! Description Monstra suffers from multiple stored XSS vulnerabilities when parsing user input to the 'menuitemlink', 'menuitemname' and 'pagetitle' parameters via POST...
Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities
Monstra 1.2.1 Multiple HTML Injection Vulnerabilities alert1;' / alert2;' / input type="hidden" name="day" value="21"...
Monstra CMS 1.1.6 Cross Site Request Forgery
1=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 0 0 x Official Website: http://www.1337day.com 1 1 x...
Monstra - Version 1.1.6 Multiple CSRF Vulnerability
Exploit for php platform in category web applications 1=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1...
