gforge4519-sql.txt

Gforge = 4.5.19 Multiple Sql Injections Vendor Notified: 2008-10-06 Note: should work regardless magicquotesgpc setting. http://gforgesite.xxx/new/?groupid=&limit=50&offset=50;select 1 as id,CURRENTUSER as forumid, version as summary...

Kusaba 1.0.4 - Remote Code Execution (1)

After execution: http://www.kusaba.image.board/url/kasubaoek/oekaki.php?pc=print "Hello"; http://www.kusaba.image.board/url/kasubaoek/oekaki.php?sc=echo Hello / $shellname = 'oekaki.php'; // any filename ending in php $server = 'http://www.kusaba.image.board/url/'; // BBS website, with trailing...

GForge 4.5.19 - Multiple SQL Injections

Gforge = 4.5.19 Multiple Sql Injections Vendor Notified: 2008-10-06 Note: should work regardless magicquotesgpc setting. http://gforgesite.xxx/new/?groupid=&limit=50&offset=50;select 1 as id,CURRENTUSER as forumid, version as summary...

CVE-2008-4483

Directory traversal vulnerability in index.php in Crux Gallery 1.32 and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the theme parameter...

CVE-2008-4490

CVE-2008-4490 affects phpAbook 0.8.8b and earlier, where a directory traversal vulnerability in config.inc.php exists. When magic_quotes_gpc is disabled, remote attackers can cause local file inclusion and arbitrary code execution via a .. (dot dot) sequence in the userInfo cookie. The underlying...

phpAbook <= 0.8.8b (COOKIE) Local File Inclusion Vulnerability

No description provided by source. phpAbook = 0.8.8b COOKIE Local File Inclusion Vulnerability url: http://sourceforge.net/projects/phpabook/ Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. U...

Printlog <= 0.4: Remote File Edition Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Printlog = 0.4: Remote File Edition Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= $ Program: Printlog $ File affected: index.php $ Version: 0.4 $ Download: http://www.hardkap.net/pritlog Found by Pepelux pepeluxatenye-sec.org...

mysqlquick-lfi.txt

MySQL Quick Admin = 1.5.5 COOKIE Local File Inclusion Vulnerability url: http://www.mysqlquickadmin.com/ Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. Use it at your own risk. Author will b...

Pritlog 0.4 - Filename Remote File Disclosure

Pritlog 0.4 - Filename Remote File Disclosure -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Printlog eNYe-Sec - www.enye-sec.org -- Description by the author's page -- PRITLOG is an extremely simple, small and powerful blog system. It does not use or need a MYSQL database and fully works bas...

Pritlog 0.4 - 'Filename' Remote File Disclosure

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Printlog eNYe-Sec - www.enye-sec.org -- Description by the author's page -- PRITLOG is an extremely simple, small and powerful blog system. It does not use or need a MYSQL database and fully works based on flat files. The idea is derived from a...

euploader-sql.txt

E-Uploader Pro = 1.0 SQL Injection Vulnerability Author: !DoktOR! Date found: 26.08.08 Product: E-Uploader Pro Version: 1.0 Price: $49 URL: www.scriptsfrenzy.com Download script: http://rapidshare.com/files/18285945/E-UploaderPro.PHP.NULL-DGTlicense.zip Vulnerability Class: SQL Injection Conditio...

Pro Chat Rooms 3.0.3 - SQL Injection

Author: !DoktOR! Date found: 28.09.08 Product: Pro Chat Rooms Version: 3.0.3 Price: $55 URL: www.prochatrooms.com Vulnerability Class: SQL Injection Condition: magicquotesgpc = Off Exploit 1:...

SA-2008-055 - Stock - Cross site scripting

The stock module provides the ability to query price quotes and trading volumes from various stock markets. An oversight in the menu permissions code allows any user to change the text of the heading at the top of the stock quotes page. As this text is not escaped, it is safe only for an...

awstats-exec2.txt

\nEx: awtotalh...

AWStats Totals (awstatstotals.php sort) Remote Code Execution Exploit

Exploit for unknown platform in category web applications ===================================================================== AWStats Totals awstatstotals.php sort Remote Code Execution Exploit ===================================================================== ?php / Remote Execution Exploit...

OneNews Beta 2 Multiple Vulnerabilities

/////////////// Name : OneNews Beta 2 Multiple Vulnerabilities Author : suN8HclfcrimsoNLoyd9, DaRk-CodeRs Group Source : http://sourceforge.net/project/showfiles.php?groupid=193198 Dork : Powered by One-News Greetz : all DaRk-CodeRs guys, e.wiZz, str0ke ========================== |1. XSS and html...

onenews Beta 2 - Cross-Site Scripting / HTML Injection / SQL Injection

///////////////\\\\\\\\ Name : OneNews Beta 2 Multiple Vulnerabilities Author : suN8HclfcrimsoNLoyd9, DaRk-CodeRs Group Source : http://sourceforge.net/project/showfiles.php?groupid=193198 Dork : Powered by One-News Greetz : all DaRk-CodeRs guys, e.wiZz, str0ke ========================== |1...

tinycms-lfi.txt

Name : tinyCMS 1.1.2 templater.php Local File Inclusion Vulnerability Author : cOndemned Dark-Coders Greetz : Avantura, str0ke, ZaBeaTy, doctor, voo|doo, sid.psycho, irk4z Conditions : Magic quotes gpc = Off / Register Globals = On Other info : Prior versions probably are vulnerable too Source of...

tinyCMS 1.1.2 (templater.php) Local File Inclusion Vulnerability

No description provided by source. Name : tinyCMS 1.1.2 templater.php Local File Inclusion Vulnerability Author : cOndemned Dark-Coders Greetz : Avantura, str0ke, ZaBeaTy, doctor, voo|doo, sid.psycho, irk4z Conditions : Magic quotes gpc = Off / Register Globals = On Other info : Prior versions...

cyberBB 0.6 Multiple Remote SQL Injection Vulnerabilities

No description provided by source. Name : cyberBB v. 0.6 Multiply Remote SQL Injection Vulnerabilities Author : cOndemned Dark-Coders Greetz : Avantura, str0ke, ZaBeaTy, voo|doo, irk4z, and many, many more... Conditions : Magic quotes gpc = On & Off / User must be logged into source of...