Sql injection

SQL injection vulnerability in news.php in webSPELL 4.01.02, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388...

CVE-2007-1019

CVE-2007-1019 is a SQL injection in the webSPELL 4.01.02 system. The vulnerability occurs in news.php when register_globals is enabled, allowing remote attackers to inject arbitrary SQL via the showonly parameter to index.php (a different vector from CVE-2006-5388). Connected sources confirm the ...

CVE-2007-1019

SQL injection vulnerability in news.php in webSPELL 4.01.02, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388...

webSPELL <= 4.01.02 (topic) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================== webSPELL "; print "\n! Example: perl ws.pl 127.0.0.1 /webspell/ -tid 1 -uid 2 -t myuser"; print "\n! Options:"; print "\n -tid no Valid topic-ID"; print "\n -uid no User-ID, default ...

webSPELL 4.01.02 - 'topic' SQL Injection

!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV2 print "\n \'/ "; print "\n -.- "; print "\n -------------------oOO------OOo-------------------"; print "\n | webSPELL "; print "\n! Example: perl ws.pl 127.0.0.1 /webspell/ -tid 1 -uid 2 -t myuser"; print "\n! Options:"; print "\n -ti...

webSPELL 4.01.02 - topic SQL Injection

webSPELL 4.01.02 - topic SQL Injection !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV2 print "\n \'/ "; print "\n -.- "; print "\n -------------------oOO------OOo-------------------"; print "\n | webSPELL "; print "\n! Example: perl ws.pl 127.0.0.1 /webspell/ -tid 1 -uid 2 -t...

CVE-2007-1019: Undefined Security Weakness

SQL injection vulnerability in news.php in webSPELL 4.01.02, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388...

webSPELL 4.01.02 (showonly) Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \'/ "; print " -.- "; print " -------------------oOO------OOo-------------------"; print " | webSPELL v4.01.02 showonly Remote SQL Injection |"; print " | works only with...

webSPELL 4.01.02 (showonly) Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================== webSPELL 4.01.02 showonly Remote Blind SQL Injection Exploit ============================================================== !/usr/bin/perl use LWP::UserAgent; use Getopt::Long;...

webSPELL 4.01.02 - showonly Blind SQL Injection

webSPELL 4.01.02 - showonly Blind SQL Injection !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print "\n \'/ "; print "\n -.- "; print "\n -------------------oOO------OOo-------------------"; print "\n | webSPELL v4.01.02 showonly Remote SQL Injection |"; print "\n | works only...

webSPELL 4.01.02 - 'showonly' Blind SQL Injection

!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print "\n \'/ "; print "\n -.- "; print "\n -------------------oOO------OOo-------------------"; print "\n | webSPELL v4.01.02 showonly Remote SQL Injection |"; print "\n | works only with registerglobals = on |"; print "\n | coded by...

WebSpell Gallery.PHP SQL注入漏洞

WebSpell是一款基于PHP的WEB应用程序。 WebSpell不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'Gallery.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL脚本代码作为参数数据，可更改原来的SQL逻辑，导致获得敏感信息。 webSPELL 4.1.2 目前没有解决方案提供： http://www.webspell.org/ //webSPELL SQL-injection exploit in gallery.php $xpl = new phpsploit; $xpl-allowredirection1;...

Drupal Acidfree模块节点标题SQL注入漏洞

WebSpell是一款基于PHP的WEB应用程序。 WebSpell不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是脚本对用户提交的Node标题参数缺少过滤，提交恶意SQL脚本代码作为参数数据，可更改原来的SQL逻辑，导致获得敏感信息。 Drupal Acidfree Module 4.7 Drupal Acidfree Module 4.6 厂商解决方案 升级程序： Drupal Acidfree Module 4.6 Drupal acidfree-4.6.x-1.0.tar.gz...

Sql injection

SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands via the picID parameter, a different vector than CVE-2007-0492...

CVE-2007-0502

SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands via the picID parameter, a different vector than CVE-2007-0492...

CVE-2007-0502

The CVE-2007-0502 entry corresponds to a SQL injection in webSPELL 4.01.02, affecting gallery.php via the picID parameter. The vulnerability is remote and allows arbitrary SQL execution; this is a separate vector from CVE-2007-0492. Connected documents confirm the affected application (webSPELL 4...

CVE-2007-0502

SQL injection vulnerability in gallery.php in webSPELL 4.01.02 allows remote attackers to execute arbitrary SQL commands via the picID parameter, a different vector than CVE-2007-0492...

Sql injection

Multiple SQL injection vulnerabilities in gallery.php in webSPELL 4.01.02 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id or 2 galleryID parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0492

Multiple SQL injection vulnerabilities in gallery.php in webSPELL 4.01.02 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id or 2 galleryID parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0492

CVE-2007-0492 involves multiple SQL injection vulnerabilities in gallery.php of webSPELL 4.01.02 and earlier. The underlying issue is unsanitized input parameters (1) id or (2) galleryID that allow remote attackers to inject arbitrary SQL commands, enabling data tampering or extraction. The vulne...