vBulletin 2.3.x - global.php SQL Injection

vBulletin 2.3.x - global.php SQL Injection source: https://www.securityfocus.com/bid/20214/info vBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

vBulletin 2.3.x - 'global.php' SQL Injection

source: https://www.securityfocus.com/bid/20214/info vBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify dat...

CVE-2006-4271

PHP remote file inclusion vulnerability in install/upgrade301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the...

CVE-2006-4272

Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service resource consumption via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations...

CVE-2006-4273

Cross-site scripting XSS vulnerability in Jelsoft vBulletin 3.5.4 and 3.6.0 allows remote attackers to inject arbitrary web script or HTML by uploading an attachment with a .pdf extension that contains JavaScript, which is processed as script by Microsoft Internet Explorer 6...

CVE-2006-4271

PHP remote file inclusion vulnerability in install/upgrade301.php in Jelsoft vBulletin 3.5.4 allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. NOTE: the vendor has disputed this vulnerability, saying "The default vBulletin requires authentication prior to the...

CVE-2006-4272

Jelsoft vBulletin 3.5.4 is affected: remote attackers can register multiple arbitrary users via the register.php endpoint, causing resource consumption/DoS. The issue is disputed by the vendor, who notes CAPTCHA can block registrations. Public details specify the vulnerability is triggered by a f...

CVE-2006-4272

Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service resource consumption via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations...

CVE-2006-4273

Affected software: Jelsoft vBulletin 3.5.4 and 3.6.0. Vulnerability type/trigger: Cross-site scripting (XSS) via uploading a .pdf attachment containing JavaScript, which is processed as script by Internet Explorer 6. Impact (as stated): enables remote script execution; documents indicate partial ...

CVE-2006-4271

CVE-2006-4271 is a PHP remote file inclusion in vBulletin 3.5.4, triggered via the step parameter in install/upgrade_301.php (or install/upgrade 301.php), allowing arbitrary PHP code execution. The vendor disputes the flaw, noting authentication is required before using the upgrade system. Connec...

CVE-2006-4273

Cross-site scripting XSS vulnerability in Jelsoft vBulletin 3.5.4 and 3.6.0 allows remote attackers to inject arbitrary web script or HTML by uploading an attachment with a .pdf extension that contains JavaScript, which is processed as script by Microsoft Internet Explorer 6...

PT-2006-5082 · Jelsoft · Vbulletin

Name of the Vulnerable Software and Affected Versions: Jelsoft vBulletin version 3.5.4 Description: The issue allows remote attackers to register multiple arbitrary users, potentially causing a denial of service due to resource consumption. This can be achieved by sending a large number of reques...

UPDATE vBulletin Version 3.5.4 exploit

vBulletin Version 3.5.4 Script : vBulletin Version 3.5.4 site : www.vbulletin.com Exploit by : x-boy E-mail : [email protected] Type : Registration flood in register.php Thanks to : Simo64 Code of exploit For english version , you can change it to other language= exploit.php cURL Must be activate...

PT-2006-5081 · Vbulletin · Vbulletin

Name of the Vulnerable Software and Affected Versions: vBulletin version 3.5.4 Description: A remote file inclusion issue in the install/upgrade 301.php file allows remote attackers to execute arbitrary PHP code via a URL in the step parameter. However, the vendor has disputed this issue, stating...

vBulletin 3.0.14 ~ init.php~ registerring global arbitary variable~ XSS exploit

ORIGINAL ADVISORY: http://myimei.com/security/2006-07-24/vbulletin-3014-initphp-XSS-exploit.html http://www.kapda.ir/advisory-397.html VENDOR CREDIT: http://www.vbulletin.com/forum/showthread.php?t=194062 ——–Summary——– Software: vBulletin Sowtware’s Web Site: http://www.vBulletin.com Versions:...

vBulletin 3.0.14 - global.php Encoded Cross-Site Scripting

vBulletin 3.0.14 - global.php Encoded Cross-Site Scripting source: https://www.securityfocus.com/bid/19358/info vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary...

vBulletin 3.0.14 - 'global.php' Encoded Cross-Site Scripting

source: https://www.securityfocus.com/bid/19358/info vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in...

vbulletin 3.5.4 IE exploit xss

--------------------------- XSS vbulletin 3.5.4 With IE --------------------------- Author:Stefan Group: EnigmaGroup --------------------------- This is XSS that only works using IE By Saving malicous code as a .pdf and uploading as a attchment on a post. when the attachment is viewed in IE only...

vbulletinexploit.txt

vBulltein 3.5.4 exploit.....install path is open or not secure Discovered By M4k3 PLDsoft Security Team, www.pldsoft.com Remote : Yes Critical Level : Dangerous Affected software description : Application : vbulletin version : latest version 3.60 Release 4 URL : http://www.vbulletin.com Exploit:...

vBulletin 3.5.4 (install_path) Exploit

vBulletin 3.5.4 installpath Exploit - by: CarcaBot - application : vbulletin - URL : http://www.vbulletin.com - Exploit: www.vicitimsite.com/forumpath/install/upgrade301.php?step=http://CarcaBot.Ro - More Details: Dump SQL DB named user then u have access at all md5 users passwords...