Hot Links download backup authorized vulnerabilities (re-post with some edit)

Hot Links is web directory system provided by mrcgiguy.com contain PHP+MySQL version and Perl version and PHP withou MySQL. All version are vulnerabilities If admin backup database will store on server and attacker can download without authorized: http://domain.ext/path/dlback.php?dl=fullback for...

CVE-2006-5905

Web Directory Pro allows remote attackers to 1 backup the database and obtain the backup via a direct request to admin/backupdb.php or 2 modify configuration via a direct request to admin/options.php...

CVE-2006-5905

Web Directory Pro allows remote attackers to 1 backup the database and obtain the backup via a direct request to admin/backupdb.php or 2 modify configuration via a direct request to admin/options.php...

CVE-2006-5905

Web Directory Pro is affected by CVE-2006-5905. The vulnerability allows remote attackers to perform two unauthorized actions via direct requests to admin/backup_db.php and admin/options.php: (1) backup the database and obtain the backup file, and (2) modify configuration. The CVSS metrics indica...

CVE-2006-5905: Undefined Security Weakness

Web Directory Pro allows remote attackers to 1 backup the database and obtain the backup via a direct request to admin/backupdb.php or 2 modify configuration via a direct request to admin/options.php...

Web Directory Pro bypass Vulnerabilities

Web Directory Pro is product of hostingfrenzy.com I check latest version and detect some security holes, attackers can backup database or re-config system: 1. Backup database: http://domain/path/admin/backupdb.php 2. Re-config system: http://domain/path/admin/options.php Note: If IE cannot downlo...

Microsoft IIS ASP Stack Overflow Exploit (MS06-034)

No description provided by source. include stdio.h include windows.h / Microsoft IIS ASP Stack Overflow ExploitMS06-034 by cocoruderfrankruderathotmail.com,2006/7/13 page:http://ruder.cdut.net/default.asp successfully test on Windows 2000 Server SP4+IIS5.0, On Windows 2003 Server+IIS6.0,because t...

Directory traversal

Unspecified vulnerability in ESTsoft InternetDISK versions before 2006/04/20 allows remote authenticated users to execute arbitrary code, possibly by uploading a file with multiple extensions into the WebLink directory...

xinnet. com China new network Web Mail system has a serious vulnerability-a vulnerability warning-the black bar safety net

Long time no Post garbage come up, this also is not prepared to contribute, to the octal friend. First good luck to all octal friends a Happy New Year. Everyone knows China's famous New cafe, new network virtual host in a stable and secure known. Business users very much, I also bought a new...

SQL injection with ASP Trojan upload another idea-vulnerability warning-the black bar safety net

Article author: absolute zero Information source: rohu.com This article for have sa permissions to the sqlserver database, and cansql injectionsupport fso+asp Server SQL injection, how to upload Trojans, has been relatively headache thing, I here upload Trojan a another method. 1, theSQL...

CVE-2005-3510: Undefined Security Weakness

Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service CPU consumption via a large number of simultaneous requests to list a web directory that has a large number of files...

CVE-2005-3386

SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3386

The CVE-2005-3386 entry describes a SQL injection vulnerability in Techno Dreams Web Directory script. Affected component: admin/login.asp (userid parameter) which allows remote attackers to execute arbitrary SQL commands and bypass authentication. This is the core vulnerability and its direct im...

CVE-2005-3386

SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

CVE-2005-3386: Undefined Security Weakness

SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp...

security flaw

The Squid package in Red Hat Linux 5.2 and 6.0, and other distributions, installs cachemgr.cgi in a public web directory, which allows remote attackers to use it as an intermediary to connect to other systems...

I-Mall Commerce (i-mall.cgi) Remote Command Execution Exploit

Exploit for cgi platform in category web applications ============================================================= I-Mall Commerce i-mall.cgi Remote Command Execution Exploit ============================================================= I-Mall explo Spawn bash style Shell with webserver uid Gree...

I-Mall Commerce - 'i-mall.cgi' Remote Command Execution

I-Mall explo Spawn bash style Shell with webserver uid Greetz z, spax, foxtwo, Zone-H This Script is currently under development use strict; use IO::Socket; my $host; my $port; my $command; my $url; my $shiz; my @results; my $probe; my @U; $U1 = "/i-mall/i-mall.cgi?p=|"; sub intro sleep 1; ; sub...

Multiple EServ bugs

Web directory listing, unauthorized FTP/HTTP proxying...

CVE-2002-1451

The vulnerability CVE-2002-1451 affects the Blazix web server (Java-based) prior to version 1.2.2. An HTTP request that ends with a "+" or a backslash "\" can disclose the JSP source code or list restricted directories, enabling partial disclosure of sensitive data. The threat is described as rem...