Pragyan CMS 3.0 - Remote File Disclosure

Pragyan CMS 3.0 - Remote File Disclosure Title Pragyan CMS v 3.0 = Remote File Disclosure Author Or4nG.M4n Download http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2 vuln download.lib.php line 16 vuln index.php line 234 $GET'fileget' exploit...

Pragyan CMS v 3.0 Remote File Disclosure

Exploit for php platform in category web applications Title Pragyan CMS v 3.0 = Remote File Disclosure Author Or4nG.M4n Download http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2 vuln download.lib.php line 16 vuln index.php line 234 $GET'fileget' exploit...

Netvidade engine 1.0 - Multiple Vulnerabilities

!/usr/bin/perl -w use strict; use LWP::UserAgent; use Getopt::Long; use MIME::Base64; '/ -.- ----------------------oOO------OOo---------------------- | | | / / / / | | / / / / / / / / / / / | | // // / / / // / // / // | | ///,// /./,/, // | | Security Research Division // 2o1o |...

DELTAScripts PHPLinks SQL Injection

/ Name : DELTAScripts PHPLinks Vuln : SQL Injection Author : Hamza 'MizoZ' N. Email : mizozxatgmaildotcom WebSite : www.greymen.org Greetz : Zuka, all friends & arab hackers / Vulnerability is in the $GET'catid' HOST/PATH/index.php?catid=8+union+all+select+1,2,3,4,5,6--...

DELTAScripts PHPLinks - 'catid' SQL Injection

/ Name : DELTAScripts PHPLinks Vuln : SQL Injection Author : Hamza 'MizoZ' N. Email : mizozxatgmaildotcom WebSite : www.greymen.org Greetz : Zuka, all friends & arab hackers / Vulnerability is in the $GET'catid' http://server/PATH/index.php?catid=8+union+all+select+1,2,3,4,5,6--...

DELTAScripts PHPLinks (catid) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================= DELTAScripts PHPLinks catid SQL Injection Vulnerability ========================================================= / Name : DELTAScripts PHPLinks Vuln : SQL Injection Author : Hamza...

phpBazar <= 2.1.1fix (cid) SQL Injection

Exploit for unknown platform in category web applications ======================================== phpBazar = 2.1.1fix cid SQL Injection ======================================== The vulnerability is in the $GET'catid' , exploit :...

phpBazar 2.1.1fix - cid SQL Injection

phpBazar 2.1.1fix - cid SQL Injection / Author : MizoZ from MA Group : EvilWay, evilwayatmaildotcom Email : mizozxatgmaildotcom Greetz : Zuka, Dyle !! MABROOK L3IIIIIIIIIID / The vulnerability is in the $GET'catid' , exploit :...

Sql injection

directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $GET"s" variable from being unset. NOTE: it could be argued that this...

CVE-2009-3064

Directory traversal vulnerability in debugger/debugphp.php in Ve-EDIT 0.1.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the GETfilename parameter...

TinyWebGallery 1.7.6 Local File Inclusion

?php / ----------------------------------------------------------- TinyWebGallery = 1.7.6 LFI / Remote Code Execution Exploit ----------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom link.....: http://www.tinywebgallery.com/ details..: this...

Cross site request forgery (csrf)

LightNEasy/lightneasy.php in LightNEasy No database version 1.2 allows remote attackers to obtain the hash of the administrator password via the setup "do" action to LightNEasy.php, which is cleared from $GET but later accessed using $REQUEST...

phpTest 0.6.3 (picture.php image_id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ======================================================================= phpTest 0.6.3 picture.php imageid Remote SQL Injection Vulnerability ======================================================================= Name : phpTest 0.6.3...

phpMyAdmin: SQL injection vulnerability

Background phpMyAdmin is a free web-based database administration tool. Description Richard Cunningham reported that phpMyAdmin uses the $REQUEST variable of $GET and $POST as a source for its parameters. Impact An attacker could entice a user to visit a malicious web application that sets an...

DoSePa 1.0.4 (textview.php) Information Disclosure Vulnerability

No description provided by source. Target: DoSePa 1.0.4 textview.php http://sourceforge.net/project/showfiles.php?groupid=91686 Vulnerability: Information disclosure. Description: The textview.php page in DoSePa does not properly sanitize the $GET'file' value; this allows an attacker to view any...

DoSePa 1.0.4 - 'textview.php' Information Disclosure

Target: DoSePa 1.0.4 textview.php http://sourceforge.net/project/showfiles.php?groupid=91686 Vulnerability: Information disclosure. Description: The textview.php page in DoSePa does not properly sanitize the $GET'file' value; this allows an attacker to view any file to which the server has read...

DoSePa 1.0.4 (textview.php) Information Disclosure Vulnerability

Exploit for unknown platform in category web applications ================================================================ DoSePa 1.0.4 textview.php Information Disclosure Vulnerability ================================================================ Target: DoSePa 1.0.4 textview.php Vulnerabilit...

Php5 GPC bypass flaw-vulnerability warning-the black bar safety net

In the discussion of specific defects before we start to learn a little about php security aspect of small things. magicquotesgpc option is php one of the important security settings, when the option is ON that is open at the time, all from GET, POST, COOKie is passed over the data in the'," and,...

Calendarix 0.7.20060401, SQL Injection Vulnerabilities

----------------------------------------------------- Advisory id: FSA:018 Author: Federico Fazzi Date: 15/06/2006, 23:36 Sinthesis: Calendarix 0.7.20060401, SQL Injection Vulnerabilities Type: low Product: http://www.calendarix.com/ Patch: unavailable...

singapore v0.9.11 cross site scripting and path disclosure

Because of singapores heavy use of classes it has multiple path disclosure occurences. The following pages all produced class related errors when navigating directly to them in your browser. gallery/includes/admin.class.php templates/admindefault/ all the .tpl.php files templates/default/ all the...