PHP168 a magical loophole, you can query any user data-bug warning-the black bar safety net

Brief description: Country micro-PHP168 appeared a magic array, can cause the whole station to the user data leakage. The leaked content includes total Station user passwords in cipher text, email, password, salt, IP and other sensitive information. Detailed description: PHP168 program...

青果教务漏洞任意妹子成绩以及照片随便看

简要描述： 可以遍历所用用户的成绩和照片，貌似用这个教务的学校不少吧 详细说明： 还是水平权限控制的问题，记得以前几乎所有页面都没进行权限校验，后来修复了，但还是有遗漏 漏洞证明： 1.照片任意遍历 http://ip/jwmis/photo/student/完整学号.JPG 2.成绩任意遍历 http://ip/jwmis/XSCJ/StuMyScoreprintrpt.aspx?rpt=1&xh=完整学号...

MosP kintai kanri fails to restrict access permissions

Overview MosP kintai kanri contains an issue where access permissions are not restricted. MosP kintai kanri is an open source attendance management software. MosP kintai kanri contains an issue where access permissions are not restricted. Masako Ohno reported this vulnerability to IPA. JPCERT/CC...

'/users/userpicker.action' exposes users loginids and full names in instance with anonymous access enabled

quote LDAP directory users and groups exposed via the /users/userpicker.action. There should be an option to restrict this to authenticated users only and perhaps this should be the default behavior. quote quote The second exposed function that is part of this vulnerability is...

Uronimo - Mobile platform website Hacked by Team Inj3ct0r

Uronimo - Mobile platform website Hacked by Team Inj3ct0r Uronimo - Mobile platform Hacked by Team Inj3ct0r today. They leak the database of site on Pastebin , including Username, Hash Password, emails and Phone Numbers of 1000 users...

a-Tech SQL Injection

+Title : a-Tech Sql Injection vulnerability +Vender : http://www.a-Tech.pl +Auther : Bl4ck.Viper Turkish Hacker +Email : [email protected] +Date : 04/07/2011 +Home : www.skote-vahshat.com +MyArchive : www.xpl.skote-vahshat.com Err0r 0n : product.php Exploit :...

Apple database hacked with SQL injection by Anonymous

Apple database hacked with SQL injection byAnonymous Anonymous hackers announce on twitter that Apple can be there next target. They expose one SQL vulnerability on Apple domain with One table "Users" data. Vulnerable Link : https://abs.apple.com:8080/ssurvey/survey?id= Exposure Link :...

EQdkp-Plus Gallery < v2.1.2 Blind SQL Injection Vulnerabilty

Exploit for php platform in category web applications ============================================================ EQdkp-Plus Gallery "EQDKP Plus" inurl:mypics.php greetz to : x2k, medison, x33, bl4ckn3ss, Luk ... / $x =...

DEBIAN-CVE-2010-1189

MediaWiki before 1.15.2 does not prevent wiki editors from linking to images from other web sites in wiki pages, which allows editors to obtain IP addresses and other information of wiki users by adding a link to an image on an attacker-controlled web site, aka "CSS validation issue."...

Preisschlacht V4 Flash System (seite&aid) index.php SQL Injection

Exploit for unknown platform in category web applications ================================================================= Preisschlacht V4 Flash System seite&aid index.php SQL Injection =================================================================...

PHP Auktion Pro SQL - news.php SQL Injection

PHP Auktion Pro SQL - news.php SQL Injection ----------------------------Information------------------------------------------------ +Name : Php Auktion Pro SQL Injection news.php +Autor : Easy Laster +Date : 22.02.2010 +Script : Php Auktion Pro +Download : ----- +Price : 34,90€ +Language :PHP...

Accommodation Hotel Booking Portal (hotel_id) SQL Injection Vuln

No description provided by source. Viva IslaM Viva IslaM Remote SQL Injection Vulnerability hotel.php hotelid Accommodation Hotel Booking Portal http://www.tourismscripts.com AuTh0r : Mr.SQL H0ME : WwW.55a.NeT Email : [email protected] -: ExploiteS :-...

RS-CMS 2.1 - key SQL Injection

RS-CMS 2.1 - key SQL Injection ======================================================= +++++++++++++++++++ information +++++++++++++++++++++++ ======================================================= + Script :RS-CMS 2.1 rscmsmodnewsview.php key Remote SQL Injection Vulnerability + Found by :...

Pixelactivo 3.0 SQL Injection

-------------------------AllaH AkbaR------------------------------- Pixelactivo Remote SQL Injection Vulnerability --------------------------------------------------------------------------- Discovered By: Snakespc ALGERIAN HaCkEr Mail: [email protected] Site:http://www.snakespc.com/sc/index.php...

Evernew Free Joke Script 1.2 SQL Injection

@=======================================@ ============taRentReXx=================== The Indian Hacker @=======================================@ @=Author : taRentReXx @=Email : [email protected] @===============INDIAN=================@ @=======================================@ @=Script :...

squirrelmail: session management flaw

A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this...

Joomla NA News Description Component SQL Injection

!/usr/bin/perl -w Joomla comnanewsdescription Sql injection Author : EcHoLL www.warezturk.org www.tahribat.com Greetz : Blacklabel TURK Godlike Nitrous ! ModuleName: comnanewsdescription ! ScriptName: Joomla ! GoogleDork: inurl:"comnanewsdescription" system"color FF0000"; system"Nohacking"; print...

Article Publisher PRO - userid SQL Injection

Article Publisher PRO - userid SQL Injection Kira has decide be back after halloween Discovered by : Mountassif Moad Type Gap : Blind Sql Injection Script : Article Publisher Pro : http://www.phparticlescript.com/ Greetz : Allah , All my freind P0c :...

EntertainmentScript 1.4.0 - 'play.php' SQL Injection

rEm0te SQL Injection Vulnerability EntertainmentScript V1.4.0 play.php id Script : EntertainmentScript.com V1.4.0 name script on demo site is fastfreemedia DeMo : http://demo.fastfreemedia.com/index.php AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM Email : [email protected] D0rK :: : not found -:: SQL :...

Linkspile (link.php cat_id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================== Linkspile link.php catid Remote SQL Injection Vulnerability ============================================================== Remote SQL Injection Vulnerabilities Linkspile link.p...