MyT Project Management 1.5.1 - Charge[group_total] SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: MyT-PM 1.5.1 - 'Chargegrouptotal' SQL Injection Exploit Author: Mehmet Önder Key Vendor Homepage: https://manageyourteam.net/ Software Link: https://sourceforge.net/projects/myt/ Version: v1.5.1 Category: Webapps Tested on: WAMP...

MyT Project Management 1.5.1 SQL Injection

Exploit Title: MyT-PM 1.5.1 - 'Chargegrouptotal' SQL Injection Date: 03.01.2019 Exploit Author: Mehmet Ander Key Vendor Homepage: https://manageyourteam.net/ Software Link: https://sourceforge.net/projects/myt/ Version: v1.5.1 Category: Webapps Tested on: WAMPP @Win Software description: MyT Mana...

Code Execution Vulnerability in Cloud CMS v1.0

Cloud CMS is a PHP+MYSQL enterprise rapid site-building system developed on the basis of Yii framework. A code execution vulnerability exists in Yundo CMS v1.0. The vulnerability stems from the program's failure to effectively filter user input, which can be exploited by attackers to cause...

Yii Search Conditional Injection Vulnerability

Yii is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . A security vulnerability exists in version 2.x of Yii prior to 2.0.15. A remote attacker can exploit the vulnerability to inject malicious search conditions...

Yii 'findByCondition' Function SQL Injection Vulnerability

Yii is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . A SQL injection vulnerability exists in the 'findByCondition' function in the framework/db/ActiveRecord.php file in version 2.x of Yii before 2.0.15. A remote...

Yii Arbitrary LUA Code Execution Vulnerability

Yii is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . A security vulnerability exists in version 2.x of Yii before 2.0.15. A remote attacker can exploit this vulnerability to execute arbitrary LUA code...

CVE-2018-8073

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

CVE-2018-8073

Yii 2.x before 2.0.15 allows remote attackers to execute arbitrary LUA code via a variant of the CVE-2018-7269 attack in conjunction with the Redis extension...

Potential SQL injection in methods `yii\db\ActiveRecord::findOne()` and `::findAll()`

More info at https://www.yiiframework.com/news/168/releasing-yii-2-0-15-and-database-extensions-with-security-fixes/...

Yii Framework Information Disclosure Vulnerability

Yii Framework is the Yii team developed a set of component-based , high-performance PHP framework for developing large-scale Web applications . A security vulnerability exists in Yii Framework 2.0.14 before version 2.x. A remote attacker can exploit this vulnerability to obtain sensitive...

CVE-2018-6010

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

Cross site request forgery (csrf)

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6010

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6010

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...

CVE-2018-6009

In Yii Framework 2.x prior to 2.0.14, the switchIdentity() function in yii\web\User.php did not regenerate the CSRF token on identity changes, potentially allowing CSRF token mismatch after login state changes. Public advisories confirm this Cross‑Site Request Forgery risk. remediation: upgrade t...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6010

CVE-2018-6010 affects Yii Framework 2.x up to and including 2.0.13 (fix in 2.0.14). The issue arises from the error handling path: remote attackers could obtain potentially sensitive information from exception messages and could exploit reflected XSS on the error handler page when running in non-...

CVE-2018-6010: Improper Neutralization of Input During Web Page Generation

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messages, or exploit reflected XSS on the error handler page in non-debug mode. Related to base/ErrorHandler.php, log/Dispatcher.php, and views/errorHandler/exception.php...