vBulletin 3.6.6 - 'calendar.php' HTML Injection

source: https://www.securityfocus.com/bid/24020/info vBulletin is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would run in the context of th...

vBulletin 3.6.6 - calendar.php HTML Injection

vBulletin 3.6.6 - calendar.php HTML Injection source: https://www.securityfocus.com/bid/24020/info vBulletin is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML...

vbul-sql.txt

!/usr/bin/perl use IO::Socket; print q DeluxeBB Remote SQL Injection Exploit vbulletin Remote SQL Injection Exploit // SekoMirza // Turkish Hackerz ; if !$ARGV2 print q Usage: perl dbbxpl.pl host /directory/ victimuserid perl dbbxpl.pl www.somesite.com /forum/ 1 ; $server = $ARGV0; $dir = $ARGV1;...

CVE-2007-1573

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field...

Sql injection

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field...

CVE-2007-1573

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field...

CVE-2007-1573

CVE-2007-1573 affects Jelsoft vBulletin 3.6.5. The vulnerability is an SQL injection in admincp/attachment.php via the Attached Before field, enabling remote authenticated administrators to execute arbitrary SQL commands. The connected sources cite the same vector and impact; no patch/version rem...

vbulletin admincp sql injection

// CREDIT: discovered by meto5757 and disfigure PRODUCT: vBulletin http://www.vbulletin.com/ VULNERABILITY: SQL Injection NOTES: - not a serious vulnerability, can only be used by administrator of site - SQL injection can be used to obtain password hash - tested on 3.6.4 and 3.6.5 POC: 1. Log in ...

vbulletin-sql.txt

// CREDIT: discovered by meto5757 and disfigure PRODUCT: vBulletin http://www.vbulletin.com/ VULNERABILITY: SQL Injection NOTES: - not a serious vulnerability, can only be used by administrator of site - SQL injection can be used to obtain password hash - tested on 3.6.4 and 3.6.5 POC: 1. Log in ...

[Full-disclosure] vbulletin admincp sql injection

// CREDIT: discovered by meto5757 and disfigure PRODUCT: vBulletin http://www.vbulletin.com/ VULNERABILITY: SQL Injection NOTES: - not a serious vulnerability, can only be used by administrator of site - SQL injection can be used to obtain password hash - tested on 3.6.4 and 3.6.5 POC: 1. Log in ...

CVE-2007-1342

Cross-site scripting XSS vulnerability in admincp/index.php in Jelsoft vBulletin 3.6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the add rss url form...

CVE-2007-1342

CVE-2007-1342 describes a cross-site scripting (XSS) vulnerability in the admincp/index.php component of Jelsoft vBulletin 3.6.5 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the add rss url form. Public records (NVD/NVD-derived entries) confirm the affe...

CVE-2007-1342

Cross-site scripting XSS vulnerability in admincp/index.php in Jelsoft vBulletin 3.6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the add rss url form...

Sql injection

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almo...

CVE-2007-1292

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almo...

CVE-2007-1292

The CVE concerns Jelsoft vBulletin SQL injection in inlinemod.php affecting versions before 3.5.8 and before 3.6.5 in the 3.6.x series. The vulnerability allows remote authenticated users to execute arbitrary SQL commands via the postids parameter. The vendor notes the attack is feasible only in ...

CVE-2007-1292

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almo...

vbul365-rssxss.txt

vBulletin® v3.6.5 has an xss vuln in admincp/index.php in rss feed . exactlly in add rss url by adding : "alertdocument.cookie; a cool messege box appear with cookies ; earlier versions affected also . ----------------------------------------------------------------------------- Discovered by...

vBulletin v3.6.5 admincp/index.php ( rss feed ) xss vuln.

vBulletin® v3.6.5 has an xss vuln in admincp/index.php in rss feed . exactlly in add rss url by adding : "scriptalertdocument.cookie;/script a cool messege box appear with cookies ; earlier versions affected also . -----------------------------------------------------------------------------...

vBulletin <= 3.6.4 (inlinemod.php postids) Remote SQL Injection Exploit

No description provided by source. ?php printr' ----------------------------------------------------------------------------- vBulletin = 3.6.4 inlinemod.php "postids" sql injection / privilege escalation by session hijacking exploit by rgod mail: retrog at alice dot it site:...