CVE-2008-6292

Acc Autos 4.0 is vulnerable to an authentication bypass where an attacker can gain administrative access by setting three cookies: username_cookie to “admin”, right_cookie to “1”, and id_cookie to “1.” This results in remote access with elevated privileges. No mitigations or patched versions are ...

Graugon Forum v1 (id) SQL Command Injection Exploit

Exploit for unknown platform in category web applications =================================================== Graugon Forum v1 id SQL Command Injection Exploit =================================================== !/usr/bin/perl...

CVE-2009-0412

The ProcessLogin function in class.auth.php in Interspire Shopping Cart ISC 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt...

Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)

Oracle Forms Cross site Scripting in iFcgi60.exe / f60servlet About: Oracle Forms is a tool somewhat like Visual Basic in appearance, but the code inside is PL/SQL which allows a developer to quickly create user-interface applications which access an Oracle database in a very efficient and...

SkaLinks 1.5 SQL Injection

Product : SkaLinks Version : 1.5 Dork : Powered by SkaLinks Site: http://www.skalinks.com/ Founded by: Dimi4 Date : 29.01.09 Greetz: antichat SQL-injection, Auth Bypass + URL: http://target.com/skalinks15/admin/ + Admin name : 1' OR 1=1/ Bug Function: function IsAdmin $tablename =...

CVE-2008-5945

Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf cookie to 1. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

DMXReady Job Listing 1.1 - Remote Contents Change

Title : DMXReady Job Listing http://target/path//applications/JobListingManager/incjoblistingmanager.asp Edit - http://target/path//admin/JobListingManager/CategoryManager/list.asp : milw0rm.com 2009-01-14...

OwenPoll 1.0 Insecure Cookie Handling Vulnerability

No description provided by source. START 0x01 Informations: Script : OwenPoll 1.0 Download : http://www.hotscripts.com/jump.php?listingid=75178&jumptype=1 Vulnerability : Insecure Cookie Handling Author : Osirys Contact : osirysatlivedotit Website : http://osirys.org Notes : Proud to be Italian...

CVE-2008-5576

admin/forums.php in sCssBoard 1.0, 1.1, 1.11, and 1.12 allows remote attackers to bypass authentication and gain administrative access via a large value of the currentuseruserslevel parameter...

CVE-2008-5423

Sun Sun Ray Server Software 3.x and 4.0 and Sun Ray Windows Connector 1.1 and 2.0 expose the LDAP password during a configuration step, which allows local users to discover the Sun Ray administration password, and obtain admin access to the Data Store and Administration GUI, via unspecified vecto...

Default credentials

Sun Sun Ray Server Software 3.x and 4.0 and Sun Ray Windows Connector 1.1 and 2.0 expose the LDAP password during a configuration step, which allows local users to discover the Sun Ray administration password, and obtain admin access to the Data Store and Administration GUI, via unspecified vecto...

CVE-2008-5422: Undefined Security Weakness

Sun Sun Ray Server Software 3.1 through 4.0 does not properly restrict access, which allows remote attackers to discover the Sun Ray administration password, and obtain admin access to the Data Store and Administration GUI, via unspecified vectors...

Product Sale Framework 0.1b SQL Injection

+++++++++++++++++++++++In The Name Of Allah+++++++++++++++++++++++++++ + + + Product Sale Framework sql injection Vulnerability + + + + Discovered by b3hz4d + + + + WwW.DeltaHacking.Net + + + + + + + ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ APA Center of Yazd...

Simple Document Management System 1.1.4 SQL Injection Auth Bypass

No description provided by source. SDMS Simple Document Management System v1.1.4 SQL Injection Author: Yuri Program: SDMS Simple Document Management System Version: v1.1.4 and probably all older versions as well Website: http://sdms.cafuego.net/ How it works The login system is very insecure, thi...

premulti-sql.txt

Pre Multi-Vendor Shopping Malls idRemote SQL Injection Vulnerability -------------------------------------------------------------------------------- ---------------------------------------------------------------- script : Pre Multi-Vendor Shopping Malls script :...

CVE-2008-4622

The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative access by setting the fn-loggedin cookie to 1...

CVE-2008-4600

configure.php in PokerMax Poker League Tournament Script 0.13 allows remote attackers to bypass authentication and gain administrative access by setting the ValidUserAdmin cookie...

CVE-2008-4600

configure.php in PokerMax Poker League Tournament Script 0.13 allows remote attackers to bypass authentication and gain administrative access by setting the ValidUserAdmin cookie...

calendars-bypass.txt

Exploit discovered by SecVuln from http://secvuln.com Come join our clan! contact [email protected] Author == SecVuln Version == 4.02 Software == Calendars for the web by great hill corporation Calendars for the web has a vulnerability in the administration page. The page saves the past session...

Calendars for the Web 4.02 - Admin Authentication Bypass

Calendars for the Web 4.02 - Admin Authentication Bypass Exploit discovered by SecVuln from http://secvuln.com Come join our clan! contact [email protected] Author == SecVuln Version == 4.02 Software == Calendars for the web by great hill corporation Calendars for the web has a vulnerability in...