sql injection in phpbb

I found a vulnerability en phpbb 2.0.5 and prior, is probably also affect 2.0.6 this bug don't affect to version 2.0.7 phpbb have a list of registereds users, when you click on a memebr of this list, you are requesting data to the database for example:...

Microsoft Windows Server 2003 "Shell Folders" Directory Traversal Vulnerability

Title: Microsoft Windows Server 2003 "Shell Folders" Directory Traversal Vulnerability http://www.geocities.co.jp/SiliconValley/1667/advisory08e.html Date: 8 October 2003 Author: Eiji James Yoshida [email protected] Vulnerable: Windows Server 2003 Internet Explorer 6.0 Overview: Windows...

Microsoft Internet Explorer 6 - '%USERPROFILE%' File Execution

source: https://www.securityfocus.com/bid/7826/info Microsoft Internet Explorer is prone to an issue which could permit an attacker to load a known, existing file in a user's temporary directory or possibly other directories in a user's profile. It is possible to exploit this issue via a maliciou...

Microsoft Internet Explorer 6 - %USERPROFILE% File Execution

Microsoft Internet Explorer 6 - %USERPROFILE% File Execution source: https://www.securityfocus.com/bid/7826/info Microsoft Internet Explorer is prone to an issue which could permit an attacker to load a known, existing file in a user's temporary directory or possibly other directories in a user's...

CSS in PHP WEB CHAT

Product: PHP WEB CHAT Version: 2.0 OffSite: http://www.webscriptworld.com Problem: Cross Site Scripting -------------------------------------------- Actions: 1Register http://victim/chatdir/register.php?register=yes&username=OverG&email=scrptalert20"Test!"/scrpt&email1=scrptalert20"Test!"/scrpt 2...

CVE-2002-1659

userprofile.asp in PortalApp 2.2 allows local users to gain privileges by modifying the userid variable...

CVE-2002-1917

CRLF injection vulnerability in the "User Profile: Send Email" feature in Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injecting a CRLF into the Subject field and adding a BCC mail header...

Ikonboard 3.1.1 multiple crossite scriptings

Ikonboard 3.1.1 There are few ways to insert HTML tags into board content. 1. Via Photo URL. In profile user can set URL of photo. It's possible to insert URL like javascript:alertdocument.cookie Javascript will be triggered if someone accesses user's profile. 2. Via X-Forwarded-For: header. User...

PHPReactor 1.2.7 - Style Attribute HTML Injection

PHPReactor 1.2.7 - Style Attribute HTML Injection source: https://www.securityfocus.com/bid/5569/info phpReactor does not sufficiently sanitize HTML from various fields such as in the body of a message or in profile fields. It is possible to inject arbitrary HTML and script code into these fields...

phpBB2 Gender Mod 1.1.3 - SQL Injection

phpBB2 Gender Mod 1.1.3 - SQL Injection source: https://www.securityfocus.com/bid/5342/info phpBB2 is an open-source web forum application that is written in PHP and backended by a number of database products. It will run on most Unix and Linux variants, as well as Microsoft Windows operating...

phpBB/gender mod allows get admin privilege, exploit/patch

Annoucement: Sua loi thay doi quyen user trong phpbb2.x In phpBB with the official Gender Mod, this vuln allows a normal user set her/himself to become a forum administrator. Nguoi viet/Author: PTTrung http://hackervn.net caothuvolam http://viethacker.net langtuhaohoa [email protected]...

phpBB2 Gender Mod 1.1.3 - SQL Injection

source: https://www.securityfocus.com/bid/5342/info phpBB2 is an open-source web forum application that is written in PHP and backended by a number of database products. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. Gender Mod is a modification for...

XMB Forum 1.6 - Magic Lantern Cross-Site Scripting

XMB Forum 1.6 - Magic Lantern Cross-Site Scripting source: https://www.securityfocus.com/bid/4721/info XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input. 1. The first involves...

XMB Forum 1.6 - Magic Lantern Cross-Site Scripting

source: https://www.securityfocus.com/bid/4721/info XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input. 1. The first involves 'member.php'; submitting script to the variable 'member' ...

Fairly serious vulnerability in vBulletin 2.2.0

This is my first report to bugtraq, I hope this is useful. This has been tested on vBulletin version 2.2.0. The vendor is CC'd on this message. I would imagine this applies to many products, not just the vbulletin, which I would like to say is more secure than most. ------------ The Exploit:...

Profile overwrite/delete due to registry size limit.

All, We have discovered a bug with NT v4.0-SP6a registry size growth and overwriting of user profiles. This bug was exposed when the SMS v2.0-SP2 client runs into a condition where it continually creates new registry keys and values filling the system registry with thousands of crap entries - thu...

CVE-2000-0214

FTP Explorer uses weak encryption for storing the username, password, and profile of FTP sites...

nt4+sp4.wts.4.0.txt

Date: Wed, 9 Jun 1999 01:07:04 +0200 From: mRm3n4c3 To: [email protected] Subject: Bug in WTS 4.0 on WinNT 4.0 sp4 I have recently encountered what i believe to be a bug in NT security when using Windows Terminal Server 4.0 on NT 4.00.1381 Service Pack 4. The problem occured in an environment...

freestats-cgi.txt

Date: Sat, 21 Nov 1998 12:54:41 -0500 From: John Carlton To: [email protected] Subject: Freestats.com CGI vulnerability About a year ago I developed an exploit for the free web stats services offered at freestats.com, and supplied the webmaster with proper code to patch the bug. After hearing ...

nt4+sp4.profile.quota.dos.txt

Date: Fri, 21 May 1999 01:15:11 +0200 From: Tonino Lucca To: [email protected] Subject: Ordinary user can easily surpass profiles quota in NT+SP4 Hi all, File system full in %systemdrive% in Terminal Server can easily be reached by an ordinary user by growing his own profile so...