Sql injection

admin/edituser.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the deluserid parameter...

CVE-2009-2328

admin/edituser.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the deluserid parameter...

CVE-2009-2255

Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/recordcompany.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the recordcompanyimage parameter in conjunction with a PATHINFO of passwordforgotten.php, then...

CVE-2009-2254

Zen Cart 1.3.8a, 1.3.8 and earlier versions are affected by an unauthenticated access flaw in admin/sqlpatch.php combined with PATH_INFO password_forgotten.php, allowing remote attackers to inject and execute arbitrary SQL via the query_string in an execute action. The issue enables potentially u...

CVE-2009-1802

Multiple cross-site request forgery CSRF vulnerabilities in FreePBX 2.5.1, and other 2.4.x, 2.5.x, and pre-release 2.6.x versions, allow remote attackers to hijack the authentication of admins for requests that create a new admin account or have unspecified other impact...

CVE-2009-1767

admin/edituser.php in 2daybiz Template Monster Clone does not require administrative authentication, which allows remote attackers to modify arbitrary accounts via the 1 loginname, 2 password, 3 email, 4 firstname, or 5 lastname parameter...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that 1 change the password, 2 add users, or 3 delete users via unknown vectors...

CVE-2009-1733

Cross-site request forgery CSRF vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that 1 change the password, 2 add users, or 3 delete users via unknown vectors...

CVE-2009-1464

CVE-2009-1464 involves CSRF vulnerabilities in index.aas of Application Access Server (A-A-S) 2.0.48 that allow remote attackers to hijack administrator authentication and trigger actions such as executing arbitrary commands, stopping services, or terminating processes via specific jobs. The vuln...

CVE-2008-6718

U&M Software JustBookIt 1.0 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to 1 usermanual.php, 2 userconfig.php, 3 userkundnamn.php, 4 userkundlista.php, 5...

CVE-2008-6717

U&M Software Signup 1.0 and 1.1 does not require administrative authentication for all scripts in the admin/ directory, which allows remote attackers to have an unspecified impact via a direct request to 1 adminstart.php, 2 admineventtype.php, 3 admineventdetails.php, 4 admineventlist.php, 5...

glFusion <= 1.1.2 COM_applyFilter()/order sql injection exploit

?php / glFusion = 1.1.2 COMapplyFilter/order sql injection exploit by Nine:Situations:Group::bookoo working against Mysql = 4.1 php.ini independent our site: http://retrogod.altervista.org/ software site: http://www.glfusion.org/ google dork: "Page created in" "seconds by glFusion" +RSS...

XGuestBook 2.0 SQL Injection

Author = FireShot , Jacopo Vuga. Mail = fireshotautisticiorg Vulnerability = SQL Admin Auth Bypass Software = XGuestBook v2.0 Download =http://script.wareseeker.com/download/xguestbook.rar/14488 Greets to = Osirys, Myral, str0ke CODE $user = $POST'user'; $pass = md5$POST'pass'; $result =...

CVE-2009-0403

SQL injection vulnerability in admin/authenticate.php in Chipmunk Blogger Script allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters...

Chipmunk Blog Add Admin Exploit

0x01 Informations: Script : Chipmunk Blog Download : http://www.chipmunk-scripts.com/blog/blog.zip Vulnerability : Add Admin Exploit\Auth Bypass Author : x0r Contact : [email protected] \ [email protected] Website : NULL 0x02 Bug: \admin\reguser.php \admin\authenticate.php if isset$POST'submit' //...

CVE-2008-5967

admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar aka .ics file with arbitrary content to the calendars/ directory outside the web root...

CVE-2008-5967

admin/index.php in PHP iCalendar 2.3.4, 2.24, and earlier does not require administrative authentication for an addupdate action, which allows remote attackers to upload a calendar aka .ics file with arbitrary content to the calendars/ directory outside the web root...

Authentication flaw

admin/auth.php in Gobbl CMS 1.0 allows remote attackers to bypass authentication and gain administrative access by setting the auth cookie to "ok"...

CVE-2008-5219

The password change feature admin/cp.php in VideoScript 4.0.1.50 and earlier does not check for administrative authentication and does not require knowledge of the original password, which allows remote attackers to change the admin account password via modified npass and npass1 parameters...

webbwebshop-sql.txt

/ / \ / / / / / / / / / / / /\ / / / / / / / / / / / / / / \ / // // / / / / // // / // / / / / / / / // / / / / / / //, / // //,/// // // /,// // // // EgY Coders Vulnerability Research TM Discovered by : Hakxer Type Gap : WEBBDOMAIN Webshop Auth Bypass All Version Script...