gurgens21.txt

Update: 1:02 AM 5/13/2005 Subject: " Gurgens Guest Book Password Database Vulnerability " Vulnerable version: Guest Book 2.1 Description: Guest Book is a complete solution which requires none or very little effort to set up and match existing website configuration. Control Panel with "Virtual...

cjultraSQL.txt

ADVISORY Sql Injection in CJ Ultra Plus v1.0.3-1.0.4? "My God, it's full of stars" - c MwNN Vulnerable code is in out.php ... if isset$perm $query = "select a1, a2 from trade where a1 = '$perm'"; So... Exploit:...

[SVadvisory] - SQL injection in OpenBook 1.2.2

SVadvisory12 Title: SQl injection Product: OpenBook Version: 1.2.2 Site: http://openbook.sourceforge.net/ Vulnerabilities Code: function authuser$userid, $password global $HTTPPOSTVARS; global $admintable; $userid=$HTTPPOSTVARS'userid'; $password=$HTTPPOSTVARS'password'; dbconnect; $query="SELECT...

[SVadvisory] - SQL injection in OpenBook 1.2.2

SVadvisory12 Title: SQl injection Product: OpenBook Version: 1.2.2 Site: http://openbook.sourceforge.net/ Vulnerabilities Code: function authuser$userid, $password global $HTTPPOSTVARS; global $admintable; $userid=$HTTPPOSTVARS'userid'; $password=$HTTPPOSTVARS'password'; dbconnect; $query="SELECT...

CVE-2005-1998

Directory traversal vulnerability in admin.php in McGallery 1.1 allows remote attackers to read arbitrary files via a .. dot dot in the lang parameter...

[Full-disclosure] Invision Power Board 1.x and 2.x Privilege Escalation Vulnerability

If an non-root admin goes to delete their own group, they are taken to a screen that says "Move users in this group to..." in which they can select the root admin group and move themselves into it. actually, they can move all users in any group into the root admin group root admins have complete...

CVE-2005-1512

CVE-2005-1512 concerns the Admin panel of PwsPHP 1.2.2 , where the upload validation for image files is inadequate. The vulnerability allows remote attackers to upload potentially arbitrary files, which could lead to arbitrary code execution on the server. The CVSS details from the entry indicate...

CVE-2005-1512

The Admin panel in PwsPHP 1.2.2 does not properly verify uploaded picture files, which allows remote attackers to upload and possibly execute arbitrary files...

e107 search.php search_info Parameter Traversal Arbitrary File Inclusion

The version of e107 installed on the remote host is affected by a remote file inclusion vulnerability because it fails to properly sanitize user-supplied input to the 'searchinfo' parameter of the 'search.php' script. This vulnerability could allow a remote, unauthenticated attacker to view...

CVE-2005-1512: Undefined Security Weakness

The Admin panel in PwsPHP 1.2.2 does not properly verify uploaded picture files, which allows remote attackers to upload and possibly execute arbitrary files...

Sql Injection in CJ Ultra Plus v1.0.3-1.0.4

ADVISORY Sql Injection in CJ Ultra Plus v1.0.3-1.0.4? "My God, it's full of stars" - c MwNN Vulnerable code is in out.php ---code begin-- ... if isset$perm $query = "select a1, a2 from trade where a1 = '$perm'"; -muhahaha $result = mysqlquery$query; if!$result errormessagesqlerror; ... ---code...

CVE-2004-0358

Cross-site scripting XSS vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via 1 the mainnews parameter in admin.php, 2 the expand parameter in admin.php, 3 the id parameter in admin.php, 4 the catid parameter in admin.php, or 5 a...

PHP-Nuke 7.4 Multiple XSS Vulnerabilities Patch

CODEBUG LABS PATCH 1 to XSS Vulnerabilities in Admin Panel of PHP-NUKE 7.4 To Patch your admin panel from this vulnerabilities hurricane you have to apply this code to your admin.php file: if !empty$HTTPGETVARS'admin' die"Shit! Mantra wins ="; if !empty$HTTPPOSTVARS'admin' die"Shit! Mantra wins =...

CVE-2004-0358

Cross-site scripting XSS vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via 1 the mainnews parameter in admin.php, 2 the expand parameter in admin.php, 3 the id parameter in admin.php, 4 the catid parameter in admin.php, or 5 a...

CVE-2004-0358

CVE-2004-0358 is a cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 . The issue allows remote attackers to execute arbitrary script as another user by supplying crafted input through multiple parameters in admin.php (specifically the mainnews , expand , id , and catid ...

CVE-2004-0358: Undefined Security Weakness

Cross-site scripting XSS vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via 1 the mainnews parameter in admin.php, 2 the expand parameter in admin.php, 3 the id parameter in admin.php, 4 the catid parameter in admin.php, or 5 a...

VirtuaNews Admin Panel 1.0.3 Pro Cross Site Scripting Vulnerabillity

Software: VirtuaNews Admin Panel Vendor: http://www.virtuanews.co.uk Versions: 1.0.3 Pro Platforms: Unix/Windows Bug: Cross Site Scripting Vulnerabillity Risk: Medium Exploitation: Remote with browser Date: 19 Feb 2004 Author: Rafel Ivgi, The-Insider e-mail: [email protected] web:...

virtuanews103.txt

Software: VirtuaNews Admin Panel Vendor: http://www.virtuanews.co.uk Versions: 1.0.3 Pro Platforms: Unix/Windows Bug: Cross Site Scripting Vulnerabillity Risk: Medium Exploitation: Remote with browser Date: 19 Feb 2004 Author: Rafel Ivgi, The-Insider e-mail: [email protected] web:...

JBrowser _admin/ Direct Request Admin Authentication Bypass

The remote host is running JBrowser - a PHP script designed to browse photos and files in a remote directory. It is possible to access the admin panel by directly requesting '/admin/'. A remote attacker could exploit this to perform administrative actions without authentication. %NASLMINLEVEL 703...

Получение доступа к панели администрирования в Willwin's Web Voting v.1.0

Получение доступа к панели администрирования в Willwin's Web Voting v.1.0 Название скрипта: Willwin's Web Voting Уязвимая версия: v.1.0 Сайт производителя: http://willwin.plex.ru Автор: [email protected] Дата: 13th December 2003 Пароль для получения доступа к панели управления голосованием в...