CVE-2009-3785

Multiple cross-site request forgery CSRF vulnerabilities in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allow remote attackers to hijack the authentication of arbitrary users via unknown vectors...

CVE-2009-3784: Cross-Site Request Forgery (CSRF)

Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2009-3785: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allow remote attackers to hijack the authentication of arbitrary users via unknown vectors...

CVE-2009-3783: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vector...

Drupal SA-CONTRIB-2009-080: Simplenews Statistics Open Redirect

The version of Drupal running on the remote web server includes the third-party Simplenews Statistics module, which provides newsletter statistics such as open and click-through rates. The version of Simplenews Statistics installed contains an open redirect, which can be used in a phishing attack...

SA-CONTRIB-2009-080 - Simplenews Statistics - Multiple vulnerabilities

The Simplenews Statistics module provides newsletter statistics such as the open rate and CTR click-through rate. The module suffers multiple vulnerabilities, including Cross Site Request Forgeries CSRF, Cross Site Scripting problem Cross Site Scripting and Open Redirect. This problem allows an...

CVE-2008-5996

Cross-site scripting XSS vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field...

Cross site scripting

Cross-site scripting XSS vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field...

CVE-2008-5996

CVE-2008-5996 is a Cross-site scripting (XSS) vulnerability in the Drupal Simplenews module (5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4). It allows remote authenticated users who possess "administer taxonomy" permissions to inject arbitrary web script or HTML via a Newsletter category field....

CVE-2008-5996

Cross-site scripting XSS vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field...

CVE-2008-5996: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field...

SA-2008-056 - Simplenews - Cross site scripting

Simplenews publishes and sends newsletters to lists of subscribers. Newsletter categories are not always properly escaped. This allows users with the "administer taxonomy" permission to add arbitrary HTML and script code to the site. Wikipedia has more information about such cross site scripting...

Simple News Print.PHP SQL注入漏洞

Simple News是一款基于PHP的WEB应用程序。 Simple News不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是'Print.PHP'脚本对用户提交的'newsid'参数缺少过滤，提交恶意SQL代码作为参数数据，可导致更改原来的SQL逻辑，获得敏感信息。 Simple News 1.0.0 FINAL 目前没有解决方案提供： http://sourceforge.net/projects/phpsns !/usr/bin/perl -w SimpleNews = 1.0.0 FINAL SQL Injection Exploit...

CVE-2007-2598

SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the newsid parameter...

Sql injection

SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the newsid parameter...

CVE-2007-2598

SQL injection in SimpleNews 1.0.0 FINAL: print.php is vulnerable via the news_id parameter, allowing remote arbitrary SQL execution. Root cause: unsafely constructed SQL in print.php. Impact: potential data compromise via the affected endpoint. Exploitation vectors are not detailed beyond the par...

CVE-2007-2598

SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the newsid parameter...

CVE-2007-2598: Undefined Security Weakness

SQL injection vulnerability in print.php in SimpleNews 1.0.0 FINAL allows remote attackers to execute arbitrary SQL commands via the newsid parameter...

SimpleNews <= 1.0.0 FINAL (print.php news_id) SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w SimpleNews = 1.0.0 FINAL SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code print.php: $newsid = $GET'newsid'; $query = "SELECT FROM simplenewsarticles WHERE...

simplenews-sql.txt

!/usr/bin/perl -w SimpleNews = 1.0.0 FINAL SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code print.php: $newsid = $GET'newsid'; $query = "SELECT FROM simplenewsarticles WHERE newsid = '$newsid'"; PoC:...