CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries...

CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries...

dotCMS 5.1.5: Exploiting H2 SQL injection to RCE

Impact The SQL injection vulnerability can be exploited as an unauthenticated attacker via CSRF or as a user of the role Publisher. An attacker is able to execute stacked SQL queries which means it is possible to manipulate arbitrary database entries and even execute shell commands when the H2...

WebOfisi E-Ticaret V4 - urun SQL Injection

WebOfisi E-Ticaret V4 - urun SQL Injection Exploit Title: WebOfisi E-Ticaret V4 - 'urun' SQL Injection Date: 2018-11-21 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.web-ofisi.com Software Demo: http://demobul.net/eticaretv4/ Software Link:...

WebOfisi E-Ticaret V4 - urun SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WebOfisi E-Ticaret V4 - 'urun' SQL Injection Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.web-ofisi.com Software Demo: http://demobul.net/eticaretv4/ Software Link:...

Rausoft ID.prove SQL Injection Vulnerability

Rausoft ID.prove is a list auditing module. The module is capable of auditing and tracking a company's customer, supplier and employee information against a blacklist. A SQL injection vulnerability exists in the login page of Rausoft ID.prove version 2.95. A remote attacker can exploit this...

CVE-2018-16659

An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xpcmdshell for the further privilege elevation...

Sql injection

An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xpcmdshell for the further privilege elevation...

CVE-2018-16659

An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xpcmdshell for the further privilege elevation...

Rausoft ID.prove 2.95 - Username SQL injection Vulnerability

Exploit for windows platform in category web applications Exploit Title: Rausoft ID.prove 2.95 - 'Username' SQL injection Google Dork: inurl:IdproveWebclient Exploit Author: Ilya Timchenko, Mercedes pay S.A. Vendor Homepage: https://www.idprove.de Software Link:...

Rausoft ID.prove 2.95 SQL Injection

Exploit Title: Rausoft ID.prove 2.95 - 'Username' SQL injection Google Dork: inurl:IdproveWebclient Date: 2018-09-26 Exploit Author: Ilya Timchenko, Mercedes pay S.A. Vendor Homepage: https://www.idprove.de Software Link:...

mooSocial Store Plugin 2.6 - SQL Injection

Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection Exploit Author: Andrea Bocchetti Date: 2018-08-28 Google Dork: N/A - Vendor: https://moosocial.com/product/store-plugins/ Software Link: https://moosocial.com/product/store-plugins/ Demo URL: http://addons.moosocial.com/stores Purchase lin...

Sokial Social Network Script 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Sokial Social Network Script 1.0 - SQL Injection Vendor Homepage: http://www.sokial.net/ Software http://www.sokial.net/demonstrations-social-network.sk Demo: http://demo.sokial.net/ Version: 1.0 Category: Webapps Tested on:...

SQLMap v1.1.8 - Automatic SQL Injection And Database Takeover Tool

SQLMap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lastin...

Cyberoam - Blind SQL Injection

Description The username field in the captive portal of Cyberoam NG firewall is vulnerable to SQL Injection and can be exploited to execute sql commands on the database. The username field is vulnerable to the following types of SQL Injections a Boolean-based blind sql injection b Stacked...

Cyberoam Firewall CR500iNG-XP 10.6.2 MR-1 - Blind SQL Injection

Cyberoam Firewall CR500iNG-XP 10.6.2 MR-1 - Blind SQL Injection Exploit Title: Cyberoam : Blind SQL Injection Date: 31/Aug/2015 Exploit Author: Dharmendra Kumar Singh Contact: [email protected] Vendor Homepage: http://www.cyberoam.com Software Link: http://www.cyberoam.com/NGFW/ Version:...

某学校综合管理系统通用SQL注入漏洞

简要描述： 某学校综合管理系统通用SQL注入漏洞 详细说明： 系统名称：学校综合管理平台 厂商：上海安脉计算机科技有限公司 关键字：版权所有：上海安脉计算机科技有限公司 系统架构：ASPX+MSSQL 漏洞文件：OA/usecar/carStat.aspx 注入参数：startdate 枚举部分案例： http://anmai.net:81/OA/usecar/carStat.aspx http://jwxx.am.jsedu.sh.cn/ANMAI/OA/usecar/carStat.aspx http://bssyxxgl.eicbs.com/OA/usecar/carStat.as...

Retrieving all tables and their columns at once MSSQL

In the Name of ALLAH the Most Beneficent and the Merciful Zenodermus, Ch3rn0by1 and Me was workinn on MSSQL.. when Zenodermus thought to make a DIOS for MSSQL.. previously at Код: http://websec.ca/kb/sqlinjection DIOS is under the heading Retrieving Multiple Tables and Columns Код: AND 1=0; BEGIN...

InvGate Service Desk 4.2.36 SQL Injection Vulnerability

InvGate Service Desk version 4.2.36 suffers from multiple remote SQL injection vulnerabilities. InvGate Service Desk v4.2.36 multiple vulnerabilities http://www.invgate.com/en/service-desk/ http://www.invgate.com/en/service-desk/on-premise-trial/ Invgate Service Desk suffers from many SQL...

InvGate Service Desk 4.2.36 SQL Injection

InvGate Service Desk v4.2.36 multiple vulnerabilities http://www.invgate.com/en/service-desk/ http://www.invgate.com/en/service-desk/on-premise-trial/ Invgate Service Desk suffers from many SQL injections as an authenticated, but non-privileged end-user role user. Most are also stacked injections...