CJ Tag Board User-Agent PHP注入漏洞

CJ Tag Board是一款基于PHP的论坛程序。 CJ Tag Board不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题一是tag.php脚本对"User-Agent" HTTP头数据缺少过滤，可导致任意PHP代码注入，并通过请求all.php脚本执行。 问题二是adminindex.php脚本对用户提交的"banned"参数缺少过滤，可导致任意PHP代码注入。 CJ Tag Board 3.0 http://www.scriptsearch.com/cgi-bin/jump.cgi?ID=10068...

Cahier de texte 2.0 (Database Backup/Source Disclosure) Remote Exploit

Exploit for unknown platform in category web applications ====================================================================== Cahier de texte 2.0 Database Backup/Source Disclosure Remote Exploit ====================================================================== !/usr/bin/perl INFORMATIONS...

CMSmelborp Beta (user_standard.php) Remote File Include Exploit

No description provided by source. !/usr/bin/perl Portal Name : CMSmelborpuserstandard.php Remote File Inclusion Exploit Bug Found DeltahackingSecurityTEAM Code :Dr.Trojan&Dr.Pantagon Download =http://superb-west.dl.sourceforge.net/sourceforge/cmsmelborp/CMSmelborp.zip usage: perl CMSmelborp.pl...

KnowledgeBuilder 2.2 - visEdit_Control.Class.php Remote File Inclusion

KnowledgeBuilder 2.2 - visEditControl.Class.php Remote File Inclusion source: https://www.securityfocus.com/bid/20857/info KnowledgeBuilder is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to...

CVE-2006-5661

Cross-site scripting XSS vulnerability in nquser.php in VIRtech Netquery allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2006-5661

Cross-site scripting XSS vulnerability in nquser.php in VIRtech Netquery allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

CVE-2006-5661: Undefined Security Weakness

Cross-site scripting XSS vulnerability in nquser.php in VIRtech Netquery allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header...

[Full-disclosure] Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

·= Security Advisory =· Issue: Cross Site Scripting XSS Vulnerability in Netquery by "VIRtech" Discovered Date: 04/10/2006 Author: Tal Argoni, LegendaryZion. talargoni at gmail.com Product Vendor: http://www.virtech.org Details: VIRtechs Netquery system is prone to a Cross Site Scripting...

Cross Site Scripting (XSS) Vulnerability in Netquery by "VIRtech"

·= Security Advisory =· Issue: Cross Site Scripting XSS Vulnerability in Netquery by "VIRtech" Discovered Date: 04/10/2006 Author: Tal Argoni, LegendaryZion. talargoni at gmail.com Product Vendor: http://www.virtech.org Details: VIRtechs Netquery system is prone to a Cross Site Scripting...

Netquery 4.0 - NQUser.php Cross-Site Scripting

Netquery 4.0 - NQUser.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20837/info Netquery is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code...

CVE-2006-5508

Multiple SQL injection vulnerabilities in addentry.php in WoltLab Burning Book 1.1.2 allow remote attackers to execute arbitrary SQL commands via 1 the n parameter and 2 the User-Agent HTTP header...

Abidia OAnywhere认证信息泄露漏洞

OAnywhere是运行在移动设备上用于在eBay上进行拍卖的工具。 OAnywhere在处理用户名和口令的传输时存在漏洞，攻击者可能通过嗅探攻击获取认证信息。 OAnywhere的更新请求会通过简单的HTTP POST包含认证。在这个过程中eBay的用户名/口令信息是通过明文发送的，这就可能导致帐号信息的暴露。 Abidia OAnywhere 厂商补丁： Abidia ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.abidia.com/products/oanywhere POST...

CVE-2006-5508: Undefined Security Weakness

Multiple SQL injection vulnerabilities in addentry.php in WoltLab Burning Book 1.1.2 allow remote attackers to execute arbitrary SQL commands via 1 the n parameter and 2 the User-Agent HTTP header...

PowerMovieList 0.13/0.14 - Edit User HTML Injection

source: https://www.securityfocus.com/bid/20564/info PowerMovieList is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute in the...

CVE-2006-5287: Undefined Security Weakness

Multiple SQL injection vulnerabilities in sign.php in Xeobook 0.93 allow remote attackers to execute arbitrary SQL commands via 1 the User-Agent HTTP header, or the 2 gbentrytext, 3 gblocation, 4 gbfullname, or 5 gbsex parameters...

CVE-2006-5227

Cross-site scripting XSS vulnerability in admin.php in TorrentFlux 2.1 allows remote attackers to inject arbitrary web script or HTML via 1 the $useragent variable, probably obtained from the User-Agent HTTP header, and possibly 2 the $ipresolved variable...

CVE-2006-5227

Cross-site scripting XSS vulnerability in admin.php in TorrentFlux 2.1 allows remote attackers to inject arbitrary web script or HTML via 1 the $useragent variable, probably obtained from the User-Agent HTTP header, and possibly 2 the $ipresolved variable...

CVE-2006-5227: Undefined Security Weakness

Cross-site scripting XSS vulnerability in admin.php in TorrentFlux 2.1 allows remote attackers to inject arbitrary web script or HTML via 1 the $useragent variable, probably obtained from the User-Agent HTTP header, and possibly 2 the $ipresolved variable...

torrentflux -- User-Agent XSS Vulnerability

Steven Roddis reports that User-Agent string is not properly escaped when handled by torrentflux. This allows for arbitrary code insertion...

CVE-2006-4451

Direct static code injection vulnerability in CJ Tag Board 3.0 allows remote attackers to execute arbitrary PHP code via the 1 User-Agent HTTP header in tag.php, which is executed by all.php, and 2 the banned parameter in adminindex.php...