XOOPS 2.3.1 - Multiple Local File Inclusions

Digital Security Research Group DSecRG Advisory DSECRG-08-040 Application: XOOPS Versions Affected: 2.3.1 Vendor URL: http://www.xoops.org/ Bug: Multiple Local File Include Exploits: YES Reported: 10.11.2008 Vendor response: 10.11.2008 Solution: YES Date of Public Advisory: 08.12.2008 Authors:...

Sql injection

SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the no parameter...

CVE-2008-5321

SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the no parameter...

CVE-2008-5321

The CVE-2008-5321 entry describes a SQL injection in the GesGaleri module (index.php) for XOOPS, exploitable via an input parameter (the none parameter is cited as the injection point). A remote attacker could execute arbitrary SQL commands according to the description and CVSS metrics (base scor...

CVE-2008-5321

SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the no parameter...

CVE-2008-5321: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in GesGaleri, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the no parameter...

Xoops远程SQLInjection漏洞

BugCVE: CAN-2002-0216 BUGTRAQ: 3977 Xoops是一个用面向对象的PHP写的开源、免费的web程序，它用MySQL作为后台数据库，可以运行于大多数的Unix和Linux系统。其userinfo.php脚本未能正确处理来自用户输入的SQL子句，攻击者可以利用某些技巧修改最终执行的SQL语句，导致敏感信息泄漏。 userinfo.php脚本没有检查用户输入的子句中是否包含特殊字符，比如提交如下URL请求结尾有个分号 http://xoops-site/userinfo.php?uid=1; 将看到如下错误信息 -snip- MySQL Query Error...

Xoops个人消息系统跨站脚本执行(CSS/XSS)漏洞

BugCVE: CAN-2002-0217 BUGTRAQ: 3978 Xoops是一个用面向对象的PHP写的开源、免费的web程序，它用MySQL作为后台数据库，可以运行于大多数的Unix和Linux系统。Xoops的用户个人消息系统存在跨站脚本执行漏洞，攻击者可能利用此漏洞窃取用户的cookie等信息。。 个人消息系统的标题栏没有很好的过滤脚本代码，当用户收到攻击者发来的个人消息，里面包含的恶意脚本代码将被执行，出现跨站脚本执行问题。这个漏洞可以让攻击者窃取用户基于cookie的认证信息等等。 1.0 RC1 如果您不能立刻安装补丁或者升级，建议您采取以下措施以降低威胁：...

CVE-2008-4653

SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-4653

SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-4653

The CVE-2008-4653 entry concerns the Makale 0.26 XOOPS module (and possibly other Makale versions). The vulnerability is a SQL injection in makale.php that allows a remote attacker to execute arbitrary SQL commands via the id parameter. The available documents consistently identify the affected c...

hisa_cart information disclosure vulnerability

Overview hisacart from Hisanaga Electric Co.Ltd contains an information disclosure vulnerability. hisacart from Hisanaga Electric Co.Ltd is a shopping cart module for XOOPS. hisacart contains a vulnerability allowing the disclosure of users' information. Impact A remote attacker could obtain...

CVE-2008-4635

Unspecified vulnerability in Hisanaga Electric Co, Ltd. hisacart 1.29 and earlier, a module for XOOPS, allows remote attackers to obtain sensitive user information via unknown vectors...

CVE-2008-4635

Unspecified vulnerability in Hisanaga Electric Co, Ltd. hisacart 1.29 and earlier, a module for XOOPS, allows remote attackers to obtain sensitive user information via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in Hisanaga Electric Co, Ltd. hisacart 1.29 and earlier, a module for XOOPS, allows remote attackers to obtain sensitive user information via unknown vectors...

makale-sql.txt

. . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z - beenu -Marezzi-P47tr1ck- FeDeReR-MAGE-JeTFyrE- DON-Outlawz-aymbrbr and all darkc0de...

CVE-2008-4653: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in makale.php in Makale 0.26 and possibly other versions, a module for XOOPS, allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-4635

Unspecified vulnerability in Hisanaga Electric Co, Ltd. hisacart 1.29 and earlier, a module for XOOPS, allows remote attackers to obtain sensitive user information via unknown vectors...

XOOPS Module makale Remote SQL Injection Vulnerability

No description provided by source. XOOPS Module: makale AUTHOR : EcHoLL HOME : http://www.warezturk.org MAİL : [email protected] DORKS 1 : dork: /modules/makale/ target: scriptpage.com/modules/makale/makale.php?id= sql Code Sql code:...