178 matches found
XMB <= 1.9.6 Final basename() Remote Command Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "XMB = 1.9.6 Final basename 'langfilenew' arbitrary local inclusion / remote commands xctn\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: "Powered by XMB"\n\n"; /...
xmb_196_cnd_xpl.txt
!/usr/bin/php -q -d shortopentag=on ? echo "XMB = 1.9.6 Final basename 'langfilenew' arbitrary local inclusion / remote commands xctn\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: "Powered by XMB"\n\n"; / works regardless of php.ini settings /...
CVE-2006-4191
Directory traversal vulnerability in memcp.php in XMB Extreme Message Board 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server...
CVE-2006-4191
The CVE-2006-4191 issue affects XMB (Extreme Message Board) up to version 1.9.6. Affected component: memcp.php. Root cause: directory traversal via the langfilenew parameter allows an attacker to cause inclusion of local files, demonstrated by injecting PHP sequences into an Apache log file that ...
CVE-2006-4191
Directory traversal vulnerability in memcp.php in XMB Extreme Message Board 1.9.6 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the langfilenew parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server...
XMB 1.9.6 Final - 'basename()' Remote Command Execution
!/usr/bin/php -q -d shortopentag=on ? echo "XMB = 1.9.6 Final basename 'langfilenew' arbitrary local inclusion / remote commands xctn\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: "Powered by XMB"\n\n"; / works regardless of php.ini settings /...
XMB 1.9.6 Final - basename() Remote Command Execution
XMB 1.9.6 Final - basename Remote Command Execution !/usr/bin/php -q -d shortopentag=on ? echo "XMB = 1.9.6 Final basename 'langfilenew' arbitrary local inclusion / remote commands xctn\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: "Powered by...
XMB <= 1.9.6 Final basename() Remote Command Execution Exploit
Exploit for unknown platform in category web applications ============================================================== XMB = 1.9.6 Final basename Remote Command Execution Exploit ============================================================== !/usr/bin/php -q -d shortopentag=on ? echo "XMB = 1.9...
CVE-2006-3994
SQL injection vulnerability in the u2usendrecp function in u2u.inc.php in XMB aka extreme message board 1.9.6 Alpha and earlier allows remote attackers to execute arbitrary SQL commands via the u2uid parameter to u2u.php, which is directly accessed from $POST and bypasses the protection scheme...
CVE-2006-3994
XMB has a SQL injection vulnerability CVE-2006-3994 in the u2u_send_recp function of u2u.inc.php (v1.9.6 Alpha and earlier). The u2uid parameter to u2u.php, which is read directly from $_POST, can be used to execute arbitrary SQL commands, bypassing the protection scheme. Affected software: XMB (...
XMB 1.9.6 - mqoff u2uid SQL Injection
XMB 1.9.6 - mqoff u2uid SQL Injection !/usr/bin/php -q -d shortopentag=on = 4.1 allowing subs / if $argc5 echo "Usage: php ".$argv0." host path username password OPTIONS\n"; echo "host: target server ip/hostname\n"; echo "path: path to XMB \n"; echo "user/pass: you need a valid user account\n";...
XMB 1.9.6 - 'mq=off' 'u2uid' SQL Injection
!/usr/bin/php -q -d shortopentag=on = 4.1 allowing subs / if $argc5 echo "Usage: php ".$argv0." host path username password OPTIONS\n"; echo "host: target server ip/hostname\n"; echo "path: path to XMB \n"; echo "user/pass: you need a valid user account\n"; echo "Options:\n"; echo " -Tprefix...
XMB <= 1.9.6 (u2uid) Remote SQL Injection Exploit (mq=off)
Exploit for unknown platform in category web applications ========================================================== XMB = 4.1 allowing subs / if $argc5 echo "Usage: php ".$argv0." host path username password OPTIONS\n"; echo "host: target server ip/hostname\n"; echo "path: path to XMB \n"; echo...
XMB <= 1.9.6 (u2uid) Remote SQL Injection Exploit (mq=off)
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "XMB = 1.9.6 'u2uid' SQL injection / admin credentials disclosure\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: "Powered by XMB"\n\n"; / works with magicquotes=off...
CVE-2006-1748
Cross-site scripting XSS vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash .SWF video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript...
Cross site scripting
Cross-site scripting XSS vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash .SWF video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript...
CVE-2006-1748
XSS vulnerability CVE-2006-1748 affects XMB Forum 1.9.5 . A Flash (.SWF) video containing a getURL call can render without ActionScript being disabled, enabling remote attackers to inject arbitrary web script/HTML. Documents confirm the root cause is improper handling of Flash content in the vide...
CVE-2006-1748
Cross-site scripting XSS vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash .SWF video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript...
XMB Forum 1.9.5-Final XSS
XMB Forum 1.9.5 I have not tested this on earlier versions allows users to embed flash .swf videos in their posts. Normally, you could set an option on the object tag to say that ActionScript cannot run, but in this case we don't. The way we execute our code is by making a flash movie containing...
Cross site scripting
Cross-site scripting XSS vulnerability in u2u.php in XMB Forums 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter, as demonstrated using a URL-encoded iframe tag...