S9Y Serendipity Freetag-plugin 2.95 - 'style' Cross-Site Scripting

source: https://www.securityfocus.com/bid/27697/info Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to laun...

Mihalism Multi Host Download (Username) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications =================================================================== Mihalism Multi Host Download Username Blind SQL Injection Exploit =================================================================== ?php / Mihalism Multi Host Download -...

Mihalism Multi Host Download (Username) Blind SQL Injection Exploit

No description provided by source. ?php / Moubik Romanian Security Team - http://rstzone.org presents Mihalism Multi Host Download - Blind SQL Injection Attack Thanks to Vladii for telling me about the CMS. Thanks to Shocker for telling Vladii about the CMS. Shoutz to Kw3rln, Bankai, Slick,...

MyBulletinBoard (MyBB) 1.2.11 - private.php SQL Injection (1)

MyBulletinBoard MyBB 1.2.11 - private.php SQL Injection 1 !/usr/bin/perl MyBB =4.1 and a valid registration. By F use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; use HTML::Entities; print"\n"; print"\n"; print" MyBB new or die" - Cannot create new UserAgent\n"; $cookiejar=HTTP::Cookies-new...

Joomla! Component Ynews 1.0.0 - 'id' SQL Injection

Title : Joomla Component Ynews 1.0.0 id Remote SQL Injection Vulnerability Author : By CrackersChild [email protected] Greetz : Str0ke,www.biyofrm.com & www.sibersavascilar.com & www.tryag.cc Dork : inurl:index.php?option=comynews Exploit :...

Simple OS CMS 0.1c_beta - login.php SQL Injection

Simple OS CMS 0.1cbeta - login.php SQL Injection source: https://www.securityfocus.com/bid/27589/info Simple OS CMS is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data. A successful exploit may allow an attacker to compromise the application, acce...

joomlanewsletter-sql.txt

joomla SQL Injectioncomnewsletter AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DorKs 1 : allinurl: "comnewsletter" EXPLOIT : index.php?option=comnewsletter&Itemid=S@BUN&listid=9999999//union//select//name,password//from//mosusers/ S@BUN www.hackturkiye.com S@BUN S@BUN GOOD LUCKY S@BUN notes:...

ASPired2Protect Login Page - SQL Injection

source: https://www.securityfocus.com/bid/27474/info ASPired2Protect is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent...

360 Web Manager 3.0 - IDFM SQL Injection

360 Web Manager 3.0 - IDFM SQL Injection 360 Web Manager CMS Remote SQL Injection Vulnerability Author: Ded MustD!e Site: http://www.360webmanager.com/ Google Dork: inurl:"IDFM=" "form.php" Exploit: http://site.com/form.php?IDM=7&IDSM=20&IDFM=-1+union+select+1,concatws0x3a,name,password,3,4...

360 Web Manager 3.0 (IDFM) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ====================================================== 360 Web Manager 3.0 IDFM SQL Injection Vulnerability ====================================================== 360 Web Manager CMS Remote SQL Injection Vulnerability Author: Ded MustD!e...

Code injection

The ptsname function in FreeBSD 6.0 through 7.0-PRERELEASE does not properly verify that a certain portion of a device name is associated with a pty of a user who is calling the ptchown function, which might allow local users to read data from the pty from another user...

MyBB 1.2.10 - moderation.php Multiple SQL Injections

MyBB 1.2.10 - moderation.php Multiple SQL Injections source: https://www.securityfocus.com/bid/27323/info MyBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an...

MTCMS <=2.0 SQL Injection Vulnerbility

...:::::MTCMS =2.0 SQL Injection Vulnerbility ::::.... Virangar Security Team www.virangar.org www.virangar.net -------- Discoverd By :hadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all hackerz greetz:to my best friend in the world hadiaryaie2004 --------...

SocialURL Login Page Cross-Site Scripting

Overview: SocialURL is a social community platform enabling you to organize your online identities. Connnect to all your social network sites with one URL. SocialURL fails to sufficiently sanitize user-supplied input data via login box. Class: Input Validation Error Example:...

Invision Power Board (IP.Board) 2.1.7 - ACTIVE Cross-Site Scripting SQL Injection

Invision Power Board IP.Board 2.1.7 - ACTIVE Cross-Site Scripting SQL Injection ---- INVISION POWER BOARD 2.1.7 EXPLOIT ... ITDefence.ru Antichat.ru INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // /...

CustomCMS 3.1 - vars.php SQL Injection

CustomCMS 3.1 - vars.php SQL Injection source: https://www.securityfocus.com/bid/27069/info CustomCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromis...

NetBizCity FaqMasterFlexPlus - faq.php SQL Injection

NetBizCity FaqMasterFlexPlus - faq.php SQL Injection source: https://www.securityfocus.com/bid/27052/info FaqMasterFlexPlus is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

mailmachine-sql.txt

--------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg --------------------------------------------------------------- Remote Sql...

MailMachine Pro 2.2.4 - SQL Injection

MailMachine Pro 2.2.4 - SQL Injection --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg...

Wallpaper Complete Website 'category.php' SQL注入漏洞

BUGTRAQ ID: 26984 CNCAN ID:CNCAN-2007122414 Wallpaper Complete Website是一款基于PHP的WEB应用程序。 Wallpaper Complete Website不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'category.php'脚本对用户提交的'catid'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Wallpaper Complete Website 1.0.9 目前没有解决方案提供：...