Douran Portal 3.9.8.25 SQL Injection

The last version of this portal which used by own company, have SQL Injection bug: http://www.douran.com/homepage.aspx?site=DouranPortal&tabid=1SQLi&lang=fa-IR Ver: DOURAN Portal V3.9.8.25 Exploit Title: Douran Portal SQLi Vulnerability Date: 08/31/2012 Author: Persia Security Group - Prince &...

Booking System Pro - Cross-Site Request Forgery

Exploit Title: Booking System Pro CSRF Vulnerability Date: 28/08/2012 Author: DaOne @LibyanCA Vendor: http://www.neptunescripts.com/products Price: $39 CSRF Add Admin...

CWE CMS Cross Site Scripting

Exploit Title: CWE. cms Cross site Scripting Vulnerability Google Dork: Intext:"Powered by CWE." Date: 08/29/2012 Author: Crim3R Site : Http://Ajaxtm.com/ Vendor Home : http://www.code-corner.com Tested on: all ================================== simplekeyword in cms.php is Vulnerable to xss...

WordPress Finder Cross Site Scripting

Exploit Title: Wordpress Finder Cross Site Scripting Vulnerability Google Dork: inurl:wp-content/plugins/finder/ Date: 08/24/2012 Author: Crim3R Tested on: all $ $ ----Author will be not responsible for any damage---- $ ======================================== the order parametr is Vulnerable to...

Area51Lab CMS SQL Injection

Exploit Title: Area51Lab cms Sql Injection Vulnerability Google Dork: intext:"Powered by Area51Lab" Date: 08/24/2012 Author: Crim3R Vendor Home : http://www.area51lab.it/ Tested on: all ======================================== news.asp?pg=news&id=idSql Injection D3M0 :...

Qualikom Canada Inc CMS SQL Injection

Exploit Title: Qualikom Canada Inc cms Sql Injection Vulnerability Google Dork:intext:"Powered by Qualikom Canada Inc." Date: 08/24/2012 Author: Crim3R Vendor Home http://www.qualikom.com/ Tested on: all $ $ ----Author will be not responsible for any damage---- $...

Server: Multiple XSS vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in ownCloud 4.5.0 allow remote attackers to inject arbitrary web script or HTML via the filename to to versions.js in apps/filesversions/js/ the filename to filelist.js in apps/files/js/ the event title to fullcalendar.js in...

Joomla 1.7 / 2.5 Civicrm Arbitrary File Upload

Exploit Title: joomla 1.7 & 2.5 comcivicrm Arbitrary File Upload Vulnerability Google Dork: inurl:/components/comcivicrm/ Date: 08/22/2012 Author: Crim3R download Link : http://sourceforge.net/projects/civicrm/files/civicrm-stable/ Tested on: all ================================== D3m0:...

PG Portal Pro - Cross-Site Request Forgery

Exploit Title: PG Portal pro CSRF Vulnerability Author: Noxious Team: WE SECRET Gr33tz: Fox link:http://www.hotscripts.com/listing/pg-portal-pro/ CSRF Change Password New Password: Confirm New Password:...

E-Mail Security Virtual Appliance (EVSA) Remote Command Execution

Exploit Title: E-Mail Security Virtual Appliance ESVA Remote Execution. Date: 10 Aug 2012 Exploit Author: iJoo Vendor Homepage: http://www.esvacommunity.com/ Software Link: http://sourceforge.net/projects/esva-project/ Version: ; while$cmd ! "exit" $content = ""; $ua = LWP::UserAgent-new;...

Cross site scripting

Cross-site scripting XSS vulnerability in the MultiBlock module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer blocks permission to inject arbitrary web script or HTML via the block title...

CVE-2012-1835

Multiple cross-site scripting XSS vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to app/view/agenda-widget-form.php; 2 args, 3 title, 4 beforetitle, or 5 aftertitle parameter...

AraDown Blind SQL Injection Vulnerability

Exploit for php platform in category web applications "; $target = stdin; $ar = array'1','2','3','4','5','6','7','8','9','0','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z'; echo " Username : "; for$i=1;$i=3...

Joomla! Component com_joomgalaxy 1.2.0.4 - Multiple Vulnerabilities

Exploit Title: Joomla joomgalaxy 1.2.0.4 Multiple Vulnerabilites dork: inurl:comjoomgalaxy Date: 01-08-2012 Author: Daniel Barragan "D4NB4R" Twitter: @D4NB4R site: http://poisonsecurity.wordpress.com/ Vendor: http://www.joomgalaxy.com/ Version: 1.2.0.4 last update on Jul 27, 2012 License:...

pBot - Remote Code Execution

pBot - Remote Code Execution !/usr/bin/perl Exploit Title: pBot Remote Code Execution "" hostauth Date: 31.07.2012 Exploit Author: @bwallHatesTwits Software Link: https://www.firebwall.com/decoding/read.php?u=620d21fd31b87046e94975e03fdafa8a decoded from attempted attack Version: Various versions...

pBot - Remote Code Execution

!/usr/bin/perl Exploit Title: pBot Remote Code Execution "" hostauth Date: 31.07.2012 Exploit Author: @bwallHatesTwits Software Link: https://www.firebwall.com/decoding/read.php?u=620d21fd31b87046e94975e03fdafa8a decoded from attempted attack Version: Various versions Tested on: Linux 3.2 use...

pBot Remote Code Execution

!/usr/bin/perl Exploit Title: pBot Remote Code Execution "" hostauth Date: 31.07.2012 Exploit Author: @bwallHatesTwits Software Link: https://www.firebwall.com/decoding/read.php?u=620d21fd31b87046e94975e03fdafa8a decoded from attempted attack Version: Various versions Tested on: Linux 3.2 use...

AxMan ActiveX fuzzing <== Memory Corruption PoC

Exploit for windows platform in category dos / poc Exploit Title: AxMan ActiveX fuzzing == Memory Corruption PoC Crash : http://imageshack.us/f/217/axman.jpg/ Date: July 28, 2012 Author: coolkaveh email protected Https://twitter.com/coolkaveh Vendor Homepage: http://digitaloffense.net/tools/axman...

Symantec Web Gateway 5.0.2 Blind SQL Injection

!/usr/bin/python Exploit Title: Symantec Web Gateway 5.0.2 blocked.php id parameter Blind SQL Injection Date: Jul 23 2012 Author: muts Version: Symantec Web Gateway 5.0.2 Vendor URL: http://www.symantec.com Timeline: 29 May 2012: Vulnerability reported to CERT 30 May 2012: Response received from...

Cross site scripting

Cross-site scripting XSS vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title...