PHPFaber TopSites 3 Admin/Index.PHP Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/23419/info TopSites is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable...

Azeno CMS SQL Injection Vulnerability

No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register class TestPOCPOCBase: vulID = 'SSV-67893' vul ID version = '1' author = 'hzr' vulDate = '2010-03-13' createDate =...

Allomani Super Multimedia Library 2.5.0 - CSRF Vulnerability (Add Admin)

No description provided by source. Super Multimedia Library 2.5.0 XSRF Vulnerability Add Admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://allomani.com/en/mediascript.html === Exploit === form method=POST...

BrudaNews <= 1.1 (admin/index.php) Remote File Include Vulnerability

No description provided by source. ============================================================================================== BrudaNews = v1.1 o Remote File Inclusion Exploit =============================================================================================== Critical Level :...

RedBLoG 0.5 admin/index.php root_path Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/20115/info The redblog application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the...

KDPics 1.18 'admin/index.php' Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/38603/info KDPics is prone to a vulnerability that lets an attacker add an administrative user because it fails to adequately secure access to administrative functionality. This may allow the attacker to compromise the...

couponPHP CMS 1.0 Multiple Stored XSS and SQL Injection Vulnerabilities

Summary couponPHP is a revolutionary content management system for running Coupon and Deal websites. It is feature rich, powerful, beautifully designed and fully automatic. Description couponPHP is vulnerable to multiple Stored XSS and SQL Injection issues. Input passed via the parameters...

CVE-2014-1459: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

CVE-2012-6631

Cross-site request forgery CSRF vulnerability in accounts/admin/index.php in Vessio NetBill 1.2 allows remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action...

CVE-2012-6631: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in accounts/admin/index.php in Vessio NetBill 1.2 allows remote attackers to hijack the authentication of administrators for requests that add accounts via a new-client action...

CVE-2012-6632: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Vessio NetBill 1.2 allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 file title to accounts/admin/index.php or 3 comment parameter in the support page to accounts/index2.php...

CVE-2012-6621: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Email Address or 2 Custom Permalink Structure fields in admin/settings.php; 3 path parameter to admin/upload.php; 4 err paramet...

易思espcms某处sql注入漏洞，附详细分析与POC代码

简要描述： 小菜刚学代码审核 详细说明： 文件 /interface/forummain.php中$userid未过滤进入sql语句 第17行到32行 function inlist parent::startpagetemplate; parent::memberpurview0, $this-mlink'orderlist'; includeonce adminROOT . 'public/classpagebotton.php'; $lng = adminLNG == 'big5' ? $this-CON'islancode' : adminLNG; $page =...

Sql injection

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

CVE-2012-4232

SQL injection vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to execute arbitrary SQL commands via the memberloginid cookie...

CVE-2012-4232

CVE-2012-4232 is a SQL Injection in jCore before 1.0pre2, exploitable via the cookie value memberloginid in /admin/index.php, allowing remote attackers to execute arbitrary SQL. Related advisory data also notes CVE-2012-4231 (XSS in path parameter) and that the vendor fixed the issue in a subsequ...

CVE-2012-4231

CVE-2012-4231 corresponds to an XSS flaw in jCore’s admin/index.php prior to 1.0pre2. The vulnerability arises from insufficient sanitization of the path parameter in the GET request, allowing an attacker to inject arbitrary HTML/Script that is executed in the victim’s browser (context of the aff...

CVE-2012-1900

CVE-2012-1900 affects RazorCMS 1.2.1 and earlier. The vulnerability is a Cross-Site Request Forgery in admin/index.php that lets remote attackers hijack an administrator’s session to perform showcats actions that delete arbitrary web pages. Root cause: CSRF in the admin interface enabling unautho...

CVE-2011-5212

SQL injection vulnerability in admin/index.php in Subrion CMS 2.0.4 allows remote attackers to execute arbitrary SQL commands via the 1 user name or 2 password field...

CVE-2012-4231: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/index.php in jCore before 1.0pre2 allows remote attackers to inject arbitrary web script or HTML via the path parameter...