PT-2010-5315

Name of the Vulnerable Software and Affected Versions phpCheckZ version 1.1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter when magic quotes gpc is disabled. Recommendations For phpCheckZ version 1.1.0, consider disabling t...

Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple XSS Vulnerabilities

Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple Cross-Site Scripting Vulnerability. SecPod Technologies www.secpod.com Author Veerendra G.G SecPod ID: 1005 09/07/2010 Issue Discovered 09/10/2010 Vendor Notified 09/13/2010 Vendor Confirmed 09/14/2010 Fix Available Class: Cross-Si...

Wiccle Web Builder CMS / iWiccle CMS Community Builder Cross Site Scripting

Wiccle Web Builder CMS and iWiccle CMS Community Builder Multiple Cross-Site Scripting Vulnerability. SecPod Technologies www.secpod.com Author Veerendra G.G SecPod ID: 1005 09/07/2010 Issue Discovered 09/10/2010 Vendor Notified 09/13/2010 Vendor Confirmed 09/14/2010 Fix Available Class: Cross-Si...

printf(1) via PHP magic_quotes Utility Command Encoder

This encoder uses the printf1 utility to avoid restricted characters. Some shell variable substitution may also be used if needed symbols are blacklisted. Some characters are intentionally left unescaped since it is assumed that PHP with magicquotesgpc enabled will escape them during request...

OvBB 0.16a Local File Inclusion

OvBB v0.16a Multiple Local File Inclusion Vulnerabilities Found by cOndemned Tested on Linux Debian apache + php5 + mysql download at http://sourceforge.net/projects/ovbb/ source of /skins/default/addevent.tpl.php 1. ?php 2. // Header. 3. $strPageTitle = " :: Calendar :. New$strType Event"; 4...

OvBB v0.16a Multiple Local File Inclusion Vulnerabilities

Exploit for php platform in category web applications ========================================================= OvBB v0.16a Multiple Local File Inclusion Vulnerabilities ========================================================= OvBB v0.16a Multiple Local File Inclusion Vulnerabilities Found by...

OvBB 0.16a - Multiple Local File Inclusions

OvBB v0.16a Multiple Local File Inclusion Vulnerabilities Found by cOndemned Tested on Linux Debian apache + php5 + mysql download at http://sourceforge.net/projects/ovbb/ source of /skins/default/addevent.tpl.php 1. ?php 2. // Header. 3. $strPageTitle = " :: Calendar :. New$strType Event"; 4...

OvBB 0.16a - Multiple Local File Inclusions

OvBB 0.16a - Multiple Local File Inclusions OvBB v0.16a Multiple Local File Inclusion Vulnerabilities Found by cOndemned Tested on Linux Debian apache + php5 + mysql download at http://sourceforge.net/projects/ovbb/ source of /skins/default/addevent.tpl.php 1. ?php 2. // Header. 3. $strPageTitle ...

Potential attack vector using attachments

Suspicious handling of attachment uploads with filenames containing quotes the quoted ended up being repeated and semicolons semicolon and all subsequent characters were stripped from filename...

Improve cookie parsing for tomcat5

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle 1 double quote " characters or 2 %5C encoded backslash sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable...

WhiteBoard 0.1.30 Blind SQL Injection

WhiteBoard 0.1.30 Multiple Blind SQL Injection Vulnerabilities Name WhiteBoard Vendor http://sarosoftware.com Versions Affected 0.1.30 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-24 X. INDEX I. ABOUT THE...

PHP-Nuke 8.1.0.3.5b (Your_Account Module) - Blind SQL Injection (Benchmark Mode)

PHP-Nuke new; my $average = 0; print "+ Calculating average load time may take a while ...\n"; for my $i = 0; $i get$hosto; my $time = time; $average += int$time-$bef; return $average/5; sub Nuke::Usage print "+ Usage: perl nuke.pl \n"; print "+ the host must be the complete path to modules.php\n...

Поиск уязвимостей в веб приложениях

В этой статье я собрал интересные на мой взгляд ошибки в php скриптах. Но для начала, описание некоторых параметров PHP-интерпретатора: Цитата: registerglobals = ON - все переменные регистрируются как глобальные; magicquotesgpc = ON - в массивах POST, GET, COOKIE экранируются кавычки и опасные...

PT-2010-4051 · Python · Mako

Name of the Vulnerable Software and Affected Versions: Mako versions prior to 0.3.4 Description: The issue makes it easier for remote attackers to conduct cross-site scripting XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element. This ...

iScripts CyberMatch 1.0 - Blind SQL Injection

iScripts CyberMatch 1.0 Blind SQL Injection Vulnerability Name iScripts CyberMatch Vendor http://www.iscripts.com Versions Affected 1.0 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-02-07 X. INDEX I. ABOUT THE...

DEDECMS website management system plus/carbuyaction. php local include vulnerability-vulnerability warning-the black bar safety net

DedeCms based on PHP+MySQL technology development, supporting Windows, Linux, Unix and other server platforms, from the 2 0 0 4 year began to publish the first version began, so far has released five large version. DedeCms in a simple, robust, flexible, open source several features occupied the...

Joomla! Component Answers 2.3beta - Multiple Vulnerabilities

Joomla! Component Answers 2.3beta - Multiple Vulnerabilities Exploit Title: Joomla Component Answers v2.3beta Multiple Vulnerabilities Date: 25 May 2010 Author: jdc Software Link: http://extensions.joomla.org/extensions/communication/forum/12652 Version: 2.3beta Tested on: PHP5, MySQL5 Blind SQL...

Daily Inspirational Quotes Script SQL Injection

Exploit Title: Daily Inspirational Quotes Script SQL Injection Vulnerability Date: 14.06.2010 Author: Valentin Category: webapps/0day Version: unknown Tested on: CVE : Code : :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Tit...

Daily Inspirational Quotes Script - SQL Injection

:::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Title = Daily Inspirational Quotes Script SQL Injection Vulnerability Author = Valentin Hoebel Contact = [email protected] :::::::::::::::::::::::::::::::::::::: 0x2...

Daily Inspirational Quotes Script SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================================= Daily Inspirational Quotes Script SQL Injection Vulnerability ============================================================= :::::::::::::::::::::::::::::::::::::: 0x1...