CosmicShoppingCart - search.php SQL Injection

CosmicShoppingCart - search.php SQL Injection Software: CosmicShoppingCart www.cosmicphp.com Risk: Medium Discovered by: Vympel Marcelo Almeida Background: CosmicShoppingCart is a PHP / MySQL e-commerce system. It is a fully customizable, shopping cart designed. SQL injections have been found, th...

CosmicShoppingCart - 'search.php' SQL Injection

Software: CosmicShoppingCart www.cosmicphp.com Risk: Medium Discovered by: Vympel Marcelo Almeida Background: CosmicShoppingCart is a PHP / MySQL e-commerce system. It is a fully customizable, shopping cart designed. SQL injections have been found, they could be exploited by users to retrieve the...

ipb search.php vulnerability analysis and thinking-vulnerability warning-the black bar safety net

Author: SuperHeiAtph4nt0m.org Blog: http://superhei.blogbus.com/ Team: http://www.ph4nt0m.org Data: 2006-04-27 Simple analysis The vulnerability is another one of pregreplace+/e vulnerability,代码 在 \sources\actionadmin\search.php line 1 2 5 8-1 2 6 a 2: if $this-ipsclass-input'lastdate' $this-outp...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO and 2 the category parameter...

CVE-2006-2506

Multiple cross-site scripting XSS vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO and 2 the category parameter...

CVE-2006-2506

CVE-2006-2506 affects Sphider’s search.php, enabling multiple XSS via PATH_INFO and the category parameter. The available connected documents confirm the vulnerable component and vectors but do not provide specific version numbers, exploit details, or remediation within the supplied material. The...

CVE-2006-2506: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in search.php in Sphider allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO and 2 the category parameter...

CVE-2006-2279: Undefined Security Weakness

Multiple SQL injection vulnerabilities in SaphpLesson 3.0 allow remote attackers to execute arbitrary SQL commands via 1 the Find parameter in a search.php, and the 2 LID and 3 Rate parameters in b misc.php...

CVE-2006-2249: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in search.php in CuteNews 1.4.1 and earlier, and possibly 1.4.5, allow remote attackers to inject arbitrary web script or HTML via the 1 user, 2 story, or 3 title parameters...

neo-Advisory-20.txt

/ --------------------------------------------------------------- Neo Security Team NST® Advisory 20 --------------------------------------------------------------- Program : CuteNews 1.4.1 Homepage: http://www.cutephp.com Vulnerable Versions: CuteNews 1.4.1 & lower ones Risk: Medium! Impact: Cro...

SaPHPLession30.txt

SaPHPLesson 3.0 Multbugs By :-- D3vil-0x1 | Devil-00 --: 1- Unfilter array Filename :- show.php Line :- 102 code $hrow = $Row2;/code Fix :- Add To Line 11 /show.php This Code :- we add the code to global to fix all unfilter ver. at the code : code $hrow = array;/code Exploit :- GET ^...

Sql injection

SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135...

Cross site scripting

Cross-site scripting XSS vulnerability in search.php in PHPKB Knowledge Base allows remote attackers to inject arbitrary web script or HTML via the searchkeyword parameter. NOTE: the issue was originally disputed by the vendor, but on 20060519, the vendor notified CVE that "We have fixed all the...

CVE-2006-2184

Cross-site scripting XSS vulnerability in search.php in PHPKB Knowledge Base allows remote attackers to inject arbitrary web script or HTML via the searchkeyword parameter. NOTE: the issue was originally disputed by the vendor, but on 20060519, the vendor notified CVE that "We have fixed all the...

CVE-2006-2189

SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135...

CVE-2006-2189

The CVE-2006-2189 issue affects sBlog 0.7.2, where search.php’s keyword parameter is not properly sanitized, allowing remote attackers to inject and execute arbitrary SQL commands. The vulnerability can also enable path disclosure as noted, indicating potential broader disclosure implications. Th...

CVE-2006-2184

CVE-2006-2184 describes a cross-site scripting (XSS) vulnerability in the PHPKB Knowledge Base product, affecting the search.php component where the vulnerability is triggered via the searchkeyword parameter. The issue allows remote attackers to inject arbitrary web script or HTML. Root cause is ...

CVE-2006-2184

Cross-site scripting XSS vulnerability in search.php in PHPKB Knowledge Base allows remote attackers to inject arbitrary web script or HTML via the searchkeyword parameter. NOTE: the issue was originally disputed by the vendor, but on 20060519, the vendor notified CVE that "We have fixed all the...

CVE-2006-2189: Undefined Security Weakness

SQL injection vulnerability in search.php in Servous sBLOG 0.7.2 allows remote attackers to execute arbitrary SQL commands via the keyword parameter. NOTE: this issue can be used to trigger path disclosure. In addition, it might be primary to vector 1 in CVE-2006-1135...

CVE-2006-2184: Undefined Security Weakness

Cross-site scripting XSS vulnerability in search.php in PHPKB Knowledge Base allows remote attackers to inject arbitrary web script or HTML via the searchkeyword parameter. NOTE: the issue was originally disputed by the vendor, but on 20060519, the vendor notified CVE that "We have fixed all the...