BIWEB企业版多处SQL注入

简要描述： 多个文件SQL注入 详细说明： search.php（BIWEB企业版几乎所有的该文件都存在这个问题） 举例：Product/search.php 文件24-60行（不止这一处） if!empty$REQUEST'productname' $strKeywords = strvalurldecodetrim$REQUEST'productname';//只是进行了简单的过滤空格和url解码 $arrKeywords = explode" ",$strKeywords;//将关键词用空格进行分割 $newArrKeywords = array;...

MyBB 1.6.12 POST Cross Site Scripting

alert/XSS/ " / document.exploit.submit;...

CTSCMS 4.0 search.php SQL注入漏洞

在/plus/search.php文件，外界传入数组的key未经过安全过滤直接赋值给变量$typeid，并且在创建对象时将变量$typeid做为参数传递给了SearchView类的构造函数，将传进来的变量$typeid直接放入SQL查询语句中执行，导致了SQL注入漏洞的产生。 0 CTSCMS 4.0 将$typeid变量进行过滤!...

RedAxScript 1.1 SQL Injection

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

Sql injection

Multiple SQL injection vulnerabilities in MYRE Realty Manager allow remote attackers to execute arbitrary SQL commands via the bathrooms1 parameter to 1 demo2/search.php or 2 search.php...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in MYRE Business Directory allows remote attackers to inject arbitrary web script or HTML via the look parameter...

PT-2013-2039

Name of the Vulnerable Software and Affected Versions MYRE Realty Manager affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the cat id1 parameter in the "search.php" endpoint. Recommendations F...

PT-2013-2038

Name of the Vulnerable Software and Affected Versions MYRE Realty Manager affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the bathrooms1 parameter to API endpoints such as "/demo2/search.php" or "/search.php"...

PT-2013-2043

Name of the Vulnerable Software and Affected Versions MYRE Business Directory affected versions not specified Description A cross-site scripting XSS issue exists in the search.php file, allowing remote attackers to inject arbitrary web script or HTML via the look parameter in the API endpoint...

CVE-2012-6589: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in MYRE Business Directory allows remote attackers to inject arbitrary web script or HTML via the look parameter...

CVE-2012-6586: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MYRE Vacation Rental Software allow remote attackers to execute arbitrary SQL commands via the 1 garage1 or 2 bathrooms1 parameter to vacation/1mobile/search.php, or 3 unspecified input to vacation/widgate/requestmoreinformation.php...

CVE-2012-6585: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in search.php in MYRE Realty Manager allows remote attackers to inject arbitrary web script or HTML via the catid1 parameter...

PT-2013-2040

Name of the Vulnerable Software and Affected Versions MYRE Vacation Rental Software affected versions not specified Description The issue concerns SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. This can be achieved through specific parameters in certa...

JBS V2.0 (search.php) - SQL Injection Vulnerability

Exploit for php platform in category web applications JBS V2.0 search.php - SQL Injection Vulnerability ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : email protected , email protected .:. Home : http://www.iphobos.com/blog/ .:...

KingCms 6.1.1641 search.php SQL注入漏洞

No description provided by source...

ecshop 2.7.2 search.php SQL注入漏洞

No description provided by source...

CTSCMS 4.0 /plus/search.php SQL注入漏洞

No description provided by source...

MantisBT search.php match_type Parameter XSS

The version of MantisBT installed on the remote host fails to properly sanitize user-supplied input to the 'matchtype' parameter of the 'search.php' script before using it to generate dynamic HTML output. An attacker may be able to leverage this to inject arbitrary HTML and script code into a...

DedeCms V57 plus/search. php file to SQL injection-vulnerability warning-the black bar safety net

Twitter on seen on the analysis,this exploit is more than one place can be utilized. Can actually disregard magicquotesgpc = On. Really not tasteless. Author: [email protected] Dedecms latest version plus/search.php file there is a variable override vulnerability,successfully exploited this...

CVE-2012-5874

Multiple SQL injection vulnerabilities in the 1 updatewhosonlinereg and 2 updatewhosonlineguest functions in Elite Bulletin Board before 2.1.22 allow remote attackers to execute arbitrary SQL commands via the PATHINFO to a checkuser.php, b groups.php, c index.php, d login.php, e quicklogin.php, f...