CVE-2009-4907

Multiple cross-site request forgery CSRF vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 force an admin logout, 3 change the visibility of posts, 4 remove links, and 5 change the name fields of a blog...

[MajorSecurity SA-070]Plume CMS - change Admin Password via Cross-site Request Forgery

MajorSecurity SA-070Plume CMS - change Admin Password via Cross-site Request Forgery Details ======= Product: Plume CMS Security-Risk: high Remote-Exploit: yes Vendor-URL: http://www.plume-cms.net/ Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz...

[MajorSecurity SA-068]Anantasoft Gazelle CMS - change admin password via Cross-site Request Forgery

MajorSecurity SA-068Anantasoft Gazelle CMS - change admin password via Cross-site Request Forgery Details ======= Product: Anantasoft Gazelle CMS Security-Risk: high Remote-Exploit: yes Vendor-URL: http://www.anantasoft.com Vendor-Status: informed Advisory-Status: published Credits ============...

YASv2.1 (by pass) Vulnerabilities

Exploit for php platform in category web applications ================================= YASv2.1 by pass Vulnerabilities ================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ ...

Joomla BF Quiz SQL Injection Exploit

!/usr/bin/python Joomla Component BF Quiz SQL Injection Exploit by Valentin Hoebel [email protected] Version 1.0 29th May 2010 ASCII FOR BREAKFAST About the vulnerability: ---------------------------------------------------------------------------- Read more here:...

YourArcadeScript 2.0b1 Blind SQL Injection

!/usr/bin/perl use LWP::UserAgent; use HTTP::Request::Common qwPOST; use Getopt::Long; '/ -.- ------------------oOO------OOo----------------- | | | / / / / | | / / / / / / / / / / / | | // // / / / // / // / // | | ///,// /./,/, // | | Security Research Division // 2o1o |...

Brekeke PBX 2.4.4.8 Cross Site Request Forgery

!--========================================================================================================= //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...

CVE-2009-4827

Cross-site request forgery CSRF vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a change action...

Design/Logic Flaw

The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to 1 change the admin password via the adminpassword parameter, 2 disable the security requirement for the Wi-Fi network via unspecified vectors, or 3 modify DNS...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a change action...

CVE-2009-4821

The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to 1 change the admin password via the adminpassword parameter, 2 disable the security requirement for the Wi-Fi network via unspecified vectors, or 3 modify DNS...

CVE-2009-4821

CVE-2009-4821 affects the D-Link DIR-615 router (firmware 3.10NA). The vulnerability is that apply.cgi does not require administrative authentication, allowing remote attackers to (1) change the admin password via the admin_password parameter, (2) disable the Wi‑Fi security requirement via unspec...

Le tour travel site management system v1. 7. 3 xday-vulnerability warning-the black bar safety net

The exploit procedure: First: The administrator directory under AdminPassod. asp !-- include file="../Include/conn. asp" - !-- include file="../Include/md5. asp" - % select case request. QueryString"Action" case "ModifyPass" SaveNewPass case else end select set rs = server. createobject"adodb...

Le tour travel site management system v1. 7. 3 Oday-vulnerability warning-the black bar safety net

Author:Lan3a First: The administrator directory under AdminPassod. asp !-- include file="../Include/conn. asp" - !-- include file="../Include/md5. asp" - % select case request. QueryString"Action" case "ModifyPass" SaveNewPass case else end select set rs = server. createobject"adodb. recordset"...

MMHAQ CMS - SQL Injection

MMHAQ CMS sqli vulnersbility +Title: MMHAQ CMS sqli vulnersbility +Version: only one version is released +Download: http://www.mmhaq.net/index.php?page=packlinux +Author: s1ayer +Contact: [email protected] Description: MMHAQ CMS fully functional Content Management System in PHP on top of MySQL...

LionWiki 3.x Shell Upload

Exploit Title: LionWiki 3.X index.php upload shell Date: monday 05 april 2010 Author: ayastar Software Link: http://lionwiki.0o.cz Version: 3.X Tested on: ubuntu 9.10 english CVE : yes Code : exploit code hi brother's and all muslims this is my first bug : dork : "powered by LionWiki " exploit :...

LionWiki 3.x - 'index.php' Arbitrary File Upload

Exploit Title: LionWiki 3.X index.php upload shell Date: monday 05 april 2010 Author: ayastar Software Link: http://lionwiki.0o.cz Version: 3.X Tested on: ubuntu 9.10 english CVE : yes Code : exploit code hi brother's and all muslims this is my first bug : dork : "powered by LionWiki " exploit :...

shopxp online shopping system v7. 4 0day-vulnerability warning-the black bar safety net

Vulnerability version: shopxp online shopping system v7. 4 Keywords: inurl:shopxpnews. asp shopxpnews. asp Storm password statement: /TEXTBOX2. ASP? action=modify&news%69d=1 2 2%20and%2 0 1=2%20union%20select%201,2,admin%2bpassword,4,5,6,7%20from%20shopxpadmin...

Adult Video Site Cross Site Request Forgery

======================================================================================== | Title : ADULT VIDEO SITE SCRIPT CSRF Chang Admin Password Exploit | Author : indoushka | Home : www.dz-blackhat.com | | Web Site : http://hotfile.com/dl/32750290/bcc0159/videoscript.rar.html | Tested on:...

DreamHost <= && > 2.3 global Inj3ct0r/Xss/Local inc Multiple Exploit

================================================= DreamHost = && 2.3 global inj3ct0r.com Exploit ================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / ...