hosting061.txt

Advisory Information ------------------------- Software Package : Hosting Controller Vendor Homepage : http://www.hostingcontroller.com Platforms : Windows based servers Vulnerability : unauthenticated user registeration Risk : High! Vulnerable Versions: All version Tested on: v.6.1 Hotfix 1.9...

CVE-2005-1654

CVE-2005-1654 affects Hosting Controller 6.1 Hotfix 1.9 and earlier. The vulnerability allows remote attackers to register arbitrary users by issuing a direct request to addsubsite.asp with the loginname and password parameters set, enabling unauthorized account creation. Related documentation ci...

Woltlab Burning Board SQL Injection Vulnerability

GulfTech Security Research May 16th, 2005 Vendor : Woltlab GmbH URL : http://www.woltlab.de/ Version : Burning Board 2. And Earlier Risk : SQL Injection Vulnerabilities Description: Burning Board is a popular, multi purpose forum / community software offered by WoltLab GmbH. There is an SQL...

Hosting Controller 0.6.1 - User Registration (2)

Hosting Controller 0.6.1 - User Registration 2 / Hosting Controller include include include include include define PORT1 80 // port of web server define PORT...

Hosting Controller <= 0.6.1 Unauthenticated User Registeration (2nd)

Exploit for unknown platform in category remote exploits ==================================================================== Hosting Controller include include s...

Hosting Controller 0.6.1 - User Registration (1)

Domain: Username: INPUT type="hidden" name="choice" value="1"...

Hosting Controller 0.6.1 - User Registration (1)

Hosting Controller 0.6.1 - User Registration 1 Domain: Username: INPUT type="hidden" name="htype" value="27" id="htyp...

Hosting Controller unauthenticated user registeration

-= Security Advisory =- Advisory Information Software Package : Hosting Controller Vendor Homepage : http://www.hostingcontroller.com Platforms : Windows based servers Vulnerability : unauthenticated user registeration Risk : High! Vulnerable Versions: All version Tested on: v.6.1 Hotfix 1.9 Vend...

CVE-2004-1651

CVE-2004-1651 affects the phpScheduleIt 1.0.0 RC1 registration page. The vulnerabilities are cross-site scripting (XSS) via user-supplied input in (1) Name, (2) Lastname, and (3) Schedule Name fields during new user registration. The root cause is insufficient input sanitization, enabling remote ...

phpScheduleIt < 1.0.0 New User Registration HTML Injection

Binary data 2191.prm...

CVE-2004-1651

Multiple cross-site scripting XSS vulnerabilities in the registration page in phpScheduleIt 1.0.0 RC1 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Lastname fields during new user registration, or 3 the Schedule Name field...

WpQuiz Gain Admin Rightd Exploit found

Ok so here is what I found Authors website wireplastik.com currently down php script I found exploit in wpquiz version 2.60b8 also tested on 2.60b 1-7 Exploit: by default wpquiz comes with a folder called extras. This folder is not password protected nor does it require any sort of authentication...

CVE-2003-1252

register.php in S8Forum 3.0 allows remote attackers to execute arbitrary PHP commands by creating a user whose name ends in a .php extension and entering the desired commands into the E-mail field, which creates a web-accessible .php file that can be called by the attacker, as demonstrated using ...

osCommerce 2.2 - SQL Injection

osCommerce 2.2 - SQL Injection !/usr/bin/perl source: https://www.securityfocus.com/bid/9211/info It has been reported that one of the scripts included with osCommerce fails to validate user-supplied input, rendering it vulnerable to a SQL injection attack. The script in question is used to verif...

Phorum Vulnerabilities

Phorum.org have acknowledged the flaws below and have released version 3.4.3 which corrects them. 1 The Phorum download program download.php is vulnerable to directory transversal attack and is able to read arbitrary files from anywhere within the root directory - with permissions of the web...

CSS in PHP WEB CHAT

Product: PHP WEB CHAT Version: 2.0 OffSite: http://www.webscriptworld.com Problem: Cross Site Scripting -------------------------------------------- Actions: 1Register http://victim/chatdir/register.php?register=yes&username=OverG&email=scrptalert20"Test!"/scrpt&email1=scrptalert20"Test!"/scrpt 2...

Web Chat Manager 2.0 - HTML Code Injection

Web Chat Manager 2.0 - HTML Code Injection source: https://www.securityfocus.com/bid/7190/info It has been reported that Web Chat Manager is prone to HTML injection attacks. This problem occurs due to insufficient sanitization of user-supplied input. As a result of this insufficiency an attacker...

A security vulnerability in S8Forum

INFORMATIONS : ============= - Product : S8Forum - Tested version : 3.0 maybe other versions. - Website : http://www.kellishaver.com/ Vendor Status: not informed yet !!! - Problem : A security vulnerability in S8Forum PROBLEM : ========= This forum writen by PHP. It doesn't use database, instead...

S8Forum 3.0 - Remote Command Execution

source: https://www.securityfocus.com/bid/6547/info S8Forum is prone to a remote command execution vulnerability. When a user registers with the forum, a file is created locally with the specified username. The contents of this file will be the data entered by the user. As a result, a malicious...

S8Forum 3.0 - Remote Command Execution

S8Forum 3.0 - Remote Command Execution source: https://www.securityfocus.com/bid/6547/info S8Forum is prone to a remote command execution vulnerability. When a user registers with the forum, a file is created locally with the specified username. The contents of this file will be the data entered ...