IceBB 1.0-rc5 - Remote Code Execution

IceBB 1.0-rc5 - Remote Code Execution !/usr/bin/perl IceBB 1.0-rc5 Remote Code Execution Exploit 1. register a user 2. run this exploit with this usage : $perl xpl.pl host&path uname pass 3. login with admin access : Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use LWP::UserAgent; use...

PBlang 4.66z - Remote Code Execution

PBlang 4.66z - Remote Code Execution !/usr/bin/perl PBlang 4.66z Remote Command Execution Exploit this Exploit register a user with admin access - magicquotesgpc = Off - Only work on 4.66z Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use IO::Socket; use LWP::UserAgent; use HTTP::Cookie...

PBlang 4.66z - Remote Code Execution

!/usr/bin/perl PBlang 4.66z Remote Command Execution Exploit this Exploit register a user with admin access - magicquotesgpc = Off - Only work on 4.66z Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $uname = $ARGV1;...

PBlang 4.66z Remote Code Execution Exploit

Exploit for unknown platform in category web applications ========================================== PBlang 4.66z Remote Code Execution Exploit ========================================== !/usr/bin/perl PBlang 4.66z Remote Command Execution Exploit this Exploit register a user with admin access -...

Cross site request forgery (csrf)

Unspecified vulnerability in web-app.org Web Automated Perl Portal WebAPP 0.9.9.4 to 0.9.9.6 allows remote attackers to obtain admin access by modifying cookies and performing "certain consecutive actions," possibly due to a cross-site request forgery CSRF vulnerability...

CVE-2007-1489

CVE-2007-1489 affects WebAPP (Web Automated Perl Portal) versions 0.9.9.4–0.9.9.6. The data in connected documents indicates a vulnerability allowing remote attackers to gain admin access by modifying cookies and performing a sequence of actions, with the likely root cause described as a cross-si...

CVE-2007-1489

Unspecified vulnerability in web-app.org Web Automated Perl Portal WebAPP 0.9.9.4 to 0.9.9.6 allows remote attackers to obtain admin access by modifying cookies and performing "certain consecutive actions," possibly due to a cross-site request forgery CSRF vulnerability...

[Full-disclosure] Blind sql injection attack in INSERT syntax on PHP-nuke <=8.0 Final

Hello, it is my new advisory: Problem:Blind sql injection attack in INSERT syntax Product:PHP-nuke =8.0 Web page:http://phpnuke.org/ Credit:Maciej krasza Kukla @mail:[email protected] homepage:www.krasza.int.pl 1.Description ...PHP-Nuke 8.0 Final version. This version includes a new anti-flood...

PT-2007-2464 · Red Hat · Jboss

Name of the Vulnerable Software and Affected Versions: JBoss affected versions not specified Description: The default configuration of JBoss does not restrict access to the console and web management interfaces, allowing remote attackers to bypass authentication and gain administrative access...

CVE-2007-0874

Allons_voter 1.0 is affected by CVE-2007-0874. Remote attackers can bypass authentication and access certain administrative functionality by issuing direct requests to admin_ajouter.php or admin_supprimer.php. The note indicates this could be leveraged to conduct cross-site scripting (XSS) attack...

KvGuestbook Remote Add Admin Exploit

Version : 1.0 Beta Download : http://www.killervault.com Files : guestbook.php Error : function dologin global $mysql, $gbpass, $gburl; $time = time + 86400365; if$gbpass == $mysql'pass' setcookie'kvgbcookie', $mysql'pass', $time, '/'; header"Location: $gburl"; $mysql, $gbpass, $gburl Mysql & Adm...

EQdkp 1.3.1 - Referer Spoof Remote Database Backup

EQdkp 1.3.1 - Referer Spoof Remote Database Backup Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected]...

uniforum4-sql.txt

Title : uniForum wbsearch.aspx Before, see "by User", it write ';update admin set Password='000245'-- Login Admin:http://www.xxx.com/path/wbadmlog.aspx Username: Administrator Password: 000245 /SQL """"""""""""""""""""" ajann,Turkey ... Im not Hacker!...

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities source: https://www.securityfocus.com/bid/22191/info Multiple VoIP phones using the Aredfox PA168 Chipset are prone to a session-hijacking vulnerability due to a design error. An attacker can exploit this issue to gain administrative...

Acidfree - SQL injection

Under certain circumstances, node titles are not escaped before being used in an SQL query, allowing a malicious user with the 'create acidfree albums' privilege and the ability to create acidfree content, to execute an SQL injection attack. These attacks may lead to administrator access. Version...

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities

source: https://www.securityfocus.com/bid/22191/info Multiple VoIP phones using the Aredfox PA168 Chipset are prone to a session-hijacking vulnerability due to a design error. An attacker can exploit this issue to gain administrative access to the embedded webserver running on the affected device...

CVE-2006-6902

Technical details about CVE-2006-6902 are not publicly available in the provided documents. The records describe an unspecified vulnerability in the Bluetooth stack of Windows Mobile Pocket PC edition, with no vectors, affected versions, or fixes detailed. Monitor for updates.

CVE-2006-6905

Technical details about CVE-2006-6905 (affected Widcomm Bluetooth stack, root-access vector, affected versions, exploit information) are not publicly provided in the connected documents. Monitor for updates.

mkportalfun.txt

MkPortal "All Guests are Admin" Exploit Vulnerability discovered and exploited by: Demential Web: http://headburn.altervista.org E-mail: infoatburnheaddotit Mkportal website: http://www.mkportal.it Start Macromedia Flash and create an swf file with this code: var idg:Number = 9; var p13:Number = ...

Drupal core - Cross site scripting

A few arguments passed via URLs are not properly sanitized before display. When an attacker is able to entice an administrator to follow a specially crafted link, arbitrary HTML and script code can be injected and executed in the victim's session. Such an attack may lead to administrator access i...