409 matches found
Symphony CMS 2.6.7 - Session Fixation
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMPHONY-CMS-SESSION-FIXATION.txt + ISR: APPARITIONSEC Vendor: ==================== www.getsymphony.com Product: ================== Symphony CMS v2.6.7 Download:...
Symphony CMS 2.6.7 Session Fixation
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/SYMPHONY-CMS-SESSION-FIXATION.txt + ISR: APPARITIONSEC Vendor: ==================== www.getsymphony.com Product: ================== Symphony CMS v2.6.7 Download:...
CompuIT CMS - Cross Site Scripting Vulnerability
Exploit for php platform in category web applications - Title : CompuIT CMS - Cross Site Scripting Vulnerability - Author : ZwX - Date : 01/12/2015 - Vendor : http://www.compuitgh.com - Tested On : Windows 7 =============================== Description Vulnerability : =============================...
CVE-2015-8124: Session Fixation in the "Remember Me" Login Feature
Affected Versions Symfony 2.3.0 to 2.3.34, 2.6.0 - 2.6.11, 2.7.0 - 2.7.6 versions of the Security component are affected by this security issue. This issue has been fixed in Symfony 2.3.35, 2.6.12, and 2.7.7. Note that no fixes are provided for Symfony 2.4 and 2.5 as they are not maintained...
SMF (Simple Machine Forum) 2.0.10 Remote Memory Exfiltration
!/usr/bin/python -- coding: iso-8859-15 -- Title: SMF Simple Machine Forum Filippo Roncari Truel Lab http://lab.truel.it Requirements: SMF = 2.0.10 PHP = 5.6.11 / 5.5.27 / 5.4.43 Advisories: TL-2015-PHP04 http://lab.truel.it/d/advisories/TL-2015-PHP04.txt TL-2015-PHP06...
CubeCart 6.0.6 Administrative Bypass
Application: CubeCart 6.0.6 5.2.12 Fixed: 07/09/2015 6.0.7 Credits: Fernando Câmara @overflowy Title: Admin account hijacking vulnerability Dork: inurl:"index.php?a=" Requirements: Default admin recovery functions enabled... Knowledge of the admin account email P.O.C Its possible for an attacker ...
Monsta FTP 1.6.2 - Multiple Vulnerabilities
Monsta FTP 1.6.2 - Multiple Vulnerabilities Exploit Title: CSRF XSS Monsta FTP Google Dork: intitle: Monsta FTP CSRF / XSS Date: 2015-09-11 Exploit Author: hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: www.monstaftp.com Software Link: www.monstaftp.com Version: monstaftpv1.6.2 Test...
ownCloud: apps.owncloud.com: Session Cookie in URL can be captured by hackers
Session Cookie in URL URL: https://apps.owncloud.com/stories/feed+rss Issue detail The URL in the request appears to contain a PHP Session token within the query string: https://apps.owncloud.com/stories/feed+rss?id=42590&PHPSESSID=ee0624300266683a4625aabea344212a Issue background Sensitive...
Fiyo CMS 2.0_1.9.1 SQL Injection
Exploit Title: Fiyo CMS multiple SQL vulnerability Date: 2015-06-28 Exploit Author: cfreer poc-lab Vendor Homepage: http://www.fiyo.org/ Software Link: http://tcpdiag.dl.sourceforge.net/project/fiyo-cms/Fiyo%202.0/fiyocms2.0.2.zip Version: 2.01.9.1 Tested on: Apache/2.4.7 Win32 CVE : CVE-2015-393...
ProjectSend r561 - SQL Injection Vulnerability
Exploit for php platform in category web applications Vulnerability title: ProjectSend r561 - SQL injection vulnerability Product: ProjectSend r561 Vendor: http://www.projectsend.org/ Affected version: ProjectSend r561 Download link: http://www.projectsend.org/download/67/ Fixed version: N/A...
RakhiSoftware Shopping Cart PHPSESSID Cookie Manipulation Path Disclosure
No description provided by source. source: http://www.securityfocus.com/bid/32563/info RakhiSoftware Shopping Cart is prone to multiple remote vulnerabilities. Exploiting these issues can allow attackers to obtain sensitive information, steal cookie data, access or modify data, or exploit latent...
SoftBiz Banner Exchange Script 1.0 lostpassword.php PHPSESSID Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/18735/info Softbiz Banner Exchange is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before displaying it to users of the application. An attacker may...
CCLeague Pro <= 1.2 Insecure Cookie Authentication Vulnerability
No description provided by source. -+================================================================================+- -+ CCLeague Pro = 1.2 Insecure Cookie Authentication Vulnerability +- -+================================================================================+- Discovered By: t0pP8uZ...
freepost 0.1 r1 - Multiple Vulnerabilities
No description provided by source. Exploit FreePost 0.1 R1 SQL Injection Date: June 6nd 2012 Author: ThE g0bL!N Version: 0.1 R1 Vendor Url: http://www.phpbrasil.com/script/dYRoLbwWuzR/freepost-01-r1 Tested on: Xp Service Pack 2 Greets To : Lider Pirata , Yassine Tablouche , Ilyes , Bilal , Habib,...
SoftBiz Banner Exchange Script 1.0 gen_confirm_mem.php PHPSESSID Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/18735/info Softbiz Banner Exchange is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before displaying it to users of the application. An attacker may...
CubeCart 5.2.8 - Session Fixation
No description provided by source. Exploit Title: CubeCart 5.2.8 Session Fixation Exploit Author: James Sibley absane Blog: http://www.pentester.co Download link: http://www.cubecart.com/download/5.2.8/zip Discovery date: March 14th, 2014 Vendor notified: March 15th, 2014 Vendor fixed: April 10th...
CVE-2013-7387
Session fixation vulnerability in DataLife Engine DLE 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie...
Session fixation
Session fixation vulnerability in DataLife Engine DLE 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie...
CVE-2013-7387
CVE-2013-7387 affects DataLife Engine (DLE) 9.7 and earlier . The vulnerability is a session fixation flaw allowing remote attackers to hijack web sessions via the PHPSESSID cookie. The connected documents specify the affected product/version and the attack vector but do not provide concrete reme...
