Aztech ADSL routers backdoor

It's possible to obtain administrative access with undocumented account isp/isp...

PhShoutBox <= 1.5 (final) Insecure Cookie Handling Vulnerability

No description provided by source. --==+================================================================================+==-- --==+ PhShoutBox = 1.5 final Insecure Cookie Handling Arbitrary Authentication +==--...

CVE-2008-1784

Prozilla Topsites 1.0 is affected. Remote attackers can perform administrative actions via direct requests to siteadmin/ addu.php, editu.php, and uidx.php. CVSSv2 base score 7.5 (HIGH) with network/vector/low complexity, no authentication. Connected sources confirm vulnerability details without a...

CVE-2008-1542

CVE-2008-1542 refers to Airspan Base Station Distribution Unit (BSDU) that uses a root password of "topsecret", enabling remote attackers to gain administrative access over Telnet. The entry describes a default-authentication weakness that allows an attacker to obtain administrative rights, repre...

ASPapp Knowledge Base - CatId SQL Injection (1)

ASPapp Knowledge Base - CatId SQL Injection 1 ....... ...... ..... .....CoRPITX ..... ..... ...... ....... -----------------Turkey-------------------------------------- --------- www.Hayalet-hack.com------------------------------- ----------www.xcorpitx-hack.com------------------------------ Iate...

phpnukekuran-sql.txt

php-nuke Kuran SQL Injectionsurano AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAİL : [email protected] DORK 1 : allinurl: "modules php name Kuran"surano DORK 2 : allinurl: "modules php name Kuran" EXPLOIT : admin...

phpnukedossiers-sql.txt

PHP-Nuke Module Dossiers Injectiondid AUTHOR : S@BUN HOME : http://www.milw0rm.com/author/1334 MAİL : [email protected] DORK 1 :allinurl:"modules.php?name=Dossiers"did DORK 2 : allinurl: EXPLOIT : admin...

WinCom LPD Server multiple security vulnerabilities

LPD buffer overflow with oversized filename, unauthorized web admin interface access, buffer and integer overflows...

digitalhive-sql.txt

body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF; font-family:Verdana,Arial; font-size:10px; vertical-align:middle; border-left:1px solid 5d5d5d; border-right:1px solid 121212;...

DigitalHive 2.0 RC2 - 'user_id' SQL Injection

body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF; font-family:Verdana,Arial; font-size:10px; vertical-align:middle; border-left:1px solid 5d5d5d; border-right:1px solid 121212;...

CVE-2008-0205

CVE-2008-0205 concerns the WordPress Math Comment Spam Protection plugin (version 2.1 and earlier). The vulnerability is a set of cross-site request forgery (CSRF) flaws in the file math-comment-spam-protection.php that let remote attackers perform administrator actions via the parameters mcsp_op...

Hosting Controller - Multiple Security Bugs (Extremely Critical)

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

Galaxie CMS 'category.php' SQL注入漏洞

BUGTRAQ ID: 26853 CNCAN ID:CNCAN-2007121404 Galaxie CMS是一款基于PHP的WEB应用程序。 Galaxie CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'category.php'脚本对用户提交的'categoryid'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Galaxie Software Galaxie CMS 暂无...

Hosting Controller 6.1 Hot fix <= 3.3 Multiple Remote Vulnerabilities

No description provided by source. Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary...

Authentication flaw

Install.php in BosDev BosNews 4 and 5 does not require authentication for replacing an existing product installation or creating a new admin account, which allows remote attackers to cause a denial of service overwritten files and possibly obtain administrative access...

CVE-2003-1488

The 1 verifadmin.php and 2 checkadmin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request to admin.php without the connect parameter and with the loggedin parameter set to any value, such as 1...

Arbitrary Command Inclusion

/ hackflatnuke.txt Tested on 2.6 FlatNuke version can work on 3 but it has to be modified With this trick you can steal/modifie a flatnuke account by changing the password and all the profile or change your profile and become an admin Requirements: - You have to know the nickname of the account u...

JBlog 1.0 - 'index.php?id' SQL Injection

Script....................................: JBlog ver 1.0 Script Site...........................: http://www.jmuller.net/jblog/index.php Vulnerability........................: Remote SQL injection Exploit Access..................................: Remote level.........................................

MKPortal 1.01.1 - admin.php Authentication Bypass

MKPortal 1.01.1 - admin.php Authentication Bypass source: https://www.securityfocus.com/bid/25515/info MKPortal is prone to an authentication-bypass vulnerability because it fails to restrict access to certain administrative functions. Attackers can exploit this issue to gain unauthorized access ...

[Full-disclosure] EZPhotoSales 1.9.3 Multiple Vulnerabilities

http://www.airscanner.com/security/07080601ezphotosales.htm Airscanner Mobile Security Advisory 07080601: EZPhotoSales 1.9.3 Multiple Vulnerabilities Product: EZPhotoSales 1.9.3 and below Platform: Windows IIS or Apache with PHP Requirements: Windows IIS or Apache with PHP Credits: Seth Fogie...