FileFuzz - Denial of Service

FileFuzz - Denial of Service Exploit Title :Filefuzzer Denial of service vulnerability Software : Filefuzzer Software link :http://labs.idefense.com/software/fuzzing.php Autor : Sweet Email : [email protected] Date : 5/11/2010 Tested on : WinXp sp3 eng | Vmware Software detail: FileFuzz is a...

Site2nite Vacation Rental (VRBO) Listings SQL Injection

Author: L0rd CrusAd3r aka VSN [email protected] Exploit Title: Site2nite Vacation Rental VRBO Listings SQL injection Vulnerability Version:FSBO Price:100$ Vendor url:http://www.site2nite.com/ Published: 2010-11-02 Thanx to:r0073r inj3ct0r.com, Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe,...

CVE-2010-4097

Multiple cross-site scripting XSS vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 mail, 2 title, 3 u, and 4 url parameters. NOTE: the q parameter is already covered by CVE-2009-2302...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 mail, 2 title, 3 u, and 4 url parameters. NOTE: the q parameter is already covered by CVE-2009-2302...

CVE-2010-4097: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in Aardvark Topsites PHP 5.2.0 and 5.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 mail, 2 title, 3 u, and 4 url parameters. NOTE: the q parameter is already covered by CVE-2009-2302...

PT-2010-5292

Name of the Vulnerable Software and Affected Versions Aardvark Topsites PHP versions 5.2.0 through 5.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via the mail, title, u, and url parameters in index.php. Recommendations For versions 5.2.0 and 5.2.1,...

Stack overflow

Stack-based buffer overflow in the UpdateFrameTitleForDocument method in the CFrameWnd class in mfc42.dll in the Microsoft Foundation Class MFC Library in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7...

Aardvark Topsite XSS vulnerability

Hi, I found XSS on Aardvark Topsites PHP system. Dork: "Powered by Aardvark Topsites" "SQL Queries" XSS: sitepath/index.php?a=search&q=2220onmouseover3dalertString.fromCharCode88,83,8320par3d22 Can use POST to effect the "email", "title", "u" and "url" parameters either on the same way. Tested...

Pulse Pro 1.4.3 - Persistent Cross-Site Scripting

Exploit Title: Pulse Pro 1.4.3 Persistent XSS Vulnerability Date: 24-10-2010 Author: Th3 RDX Software Link: http://pulsecms.com/ Version: 1.4.3 Tested on: Demo Site category: webapp Code : n/a -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= L0v3 To: R00T...

GeekLog 1.7.0 - 'FCKeditor' Arbitrary File Upload

db 88 88 ,ad8888ba, d88b 88 88 d8"' "8b d8'8b 88 88 d8' d8' 8b 88aaaaaaaa88 88 d8YaaaaY8b 88""""""""88 88 88888 d8""""""""8b 88 88 Y8, 88 d8' 8b 88 88 Y8a. .a88 d8' 8b 88 88 "Y88888P" Exploit Title: Geeklog Date: 18-10-2010 Author: Kubanezi AHG Software Link: http://www.geeklog.net/ Version: 1.7....

Ease Jukebox v1.30 Denial of Service Vulnerability

Exploit for windows platform in category dos / poc ==================================== Ease Jukebox v1.30 Denial of Service ==================================== Exploit Title :Ease Jukebox 1.30 Dos vulnerability Software : Ease Jukebox 1.30 Software link :...

MAP Category SQL Injection

======================================================= MAP Category map.php SQL Injection Vulnerability ======================================================= Exploit Title: PHP Category map.php?id SQL Injection Vulnerability Date: oktober 02, 2010 Author: josalijoe Category? : PHP Category...

PHP Category SQL Injection

======================================================= PHP Category categoryid SQL Injection Vulnerability ======================================================= Exploit Title: PHP Category categoryid SQL Injection Vulnerability Date: oktober 02, 2010 Author: josalijoe Category? : PHP Category...

jCart 1.1 Cross Site Request Forgery / Cross Site Scripting

additem$itemid, $itemqty, $itemprice, $itemname; ------------------------- User-supplied input for variable $itemname isn't properly escaped. Proof-of-Concept: -- alertdocument.cookie" type="hidden" document.getElementById'payload'.click...

Windows MessageBox

Spawns a dialog via MessageBox using a customizable title, text & icon This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 231 include Msf::Payload::Windows include Msf::Payload::Singl...

SnackAmp 3.1.3B Malicious SMP Buffer Overflow Vulnerability (SEH)

Exploit for windows platform in category local exploits ================================================================= SnackAmp 3.1.3B Malicious SMP Buffer Overflow Vulnerability SEH ================================================================= Exploit Title: SnackAmp 3.1.3B Malicious SMP...

WAnewsletter 2.1.2 - SQL Injection

================================================ WAnewsletter v 2.1.2 SQL Injection Vulnerability ================================================ Exploit Title: WAnewsletter v 2.1.2 SQL Injection Vulnerabilitie Date: 23/09/2010 Author: BrOx-Dz Author: [email protected] Software...

CVE-2010-3483: Undefined Security Weakness

cmswrite.php in Primitive CMS 1.0.9 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request. NOTE: this vulnerability can be leveraged to conduct cross-site scripting attacks, as demonstrated using the 1 title, 2 content, and 3...

CVE-2010-3482: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in cmswrite.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL commands via the 1 title and 2 menutitle parameters. NOTE: this can be leveraged with CVE-2010-3483 to conduct attacks without authentication...

Fashione E-Commerce Webshop SQL Injection

/ / / / / / / / / / // / / / / ///// // Exploit Title: Fashione E-Commerce Webshop Multiple SQL Injection Vulnerabilities Date: 2010-09-19 Author: secret Contact : [email protected] / ICQ : 17-33-77 Site : swissfaking.net/board Software Link: http://www.fashione.co.uk/ Version: All...