Design/Logic Flaw

The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to 1 change the admin password via the adminpassword parameter, 2 disable the security requirement for the Wi-Fi network via unspecified vectors, or 3 modify DNS...

CVE-2009-4821

CVE-2009-4821 affects the D-Link DIR-615 router (firmware 3.10NA). The vulnerability is that apply.cgi does not require administrative authentication, allowing remote attackers to (1) change the admin password via the admin_password parameter, (2) disable the Wi‑Fi security requirement via unspec...

Le tour travel site management system v1. 7. 3 xday-vulnerability warning-the black bar safety net

The exploit procedure: First: The administrator directory under AdminPassod. asp !-- include file="../Include/conn. asp" - !-- include file="../Include/md5. asp" - % select case request. QueryString"Action" case "ModifyPass" SaveNewPass case else end select set rs = server. createobject"adodb...

Le tour travel site management system v1. 7. 3 Oday-vulnerability warning-the black bar safety net

Author:Lan3a First: The administrator directory under AdminPassod. asp !-- include file="../Include/conn. asp" - !-- include file="../Include/md5. asp" - % select case request. QueryString"Action" case "ModifyPass" SaveNewPass case else end select set rs = server. createobject"adodb. recordset"...

MMHAQ CMS - SQL Injection

MMHAQ CMS sqli vulnersbility +Title: MMHAQ CMS sqli vulnersbility +Version: only one version is released +Download: http://www.mmhaq.net/index.php?page=packlinux +Author: s1ayer +Contact: [email protected] Description: MMHAQ CMS fully functional Content Management System in PHP on top of MySQL...

LionWiki 3.x Shell Upload

Exploit Title: LionWiki 3.X index.php upload shell Date: monday 05 april 2010 Author: ayastar Software Link: http://lionwiki.0o.cz Version: 3.X Tested on: ubuntu 9.10 english CVE : yes Code : exploit code hi brother's and all muslims this is my first bug : dork : "powered by LionWiki " exploit :...

LionWiki 3.x - 'index.php' Arbitrary File Upload

Exploit Title: LionWiki 3.X index.php upload shell Date: monday 05 april 2010 Author: ayastar Software Link: http://lionwiki.0o.cz Version: 3.X Tested on: ubuntu 9.10 english CVE : yes Code : exploit code hi brother's and all muslims this is my first bug : dork : "powered by LionWiki " exploit :...

shopxp online shopping system v7. 4 0day-vulnerability warning-the black bar safety net

Vulnerability version: shopxp online shopping system v7. 4 Keywords: inurl:shopxpnews. asp shopxpnews. asp Storm password statement: /TEXTBOX2. ASP? action=modify&news%69d=1 2 2%20and%2 0 1=2%20union%20select%201,2,admin%2bpassword,4,5,6,7%20from%20shopxpadmin...

Adult Video Site Cross Site Request Forgery

======================================================================================== | Title : ADULT VIDEO SITE SCRIPT CSRF Chang Admin Password Exploit | Author : indoushka | Home : www.dz-blackhat.com | | Web Site : http://hotfile.com/dl/32750290/bcc0159/videoscript.rar.html | Tested on:...

DreamHost <= && > 2.3 global Inj3ct0r/Xss/Local inc Multiple Exploit

================================================= DreamHost = && 2.3 global inj3ct0r.com Exploit ================================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' /' / /' 0 0 /, // ,/ / 1 1 // /' / // /' / /' 0 0 / / / / / / 1 1 / ...

CVE-2009-4675

admin/admininfo/index.php in the Mole Group Gastro Portal Restaurant Directory Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission...

Design/Logic Flaw

admin/admininfo/index.php in the Mole Group Gastro Portal Restaurant Directory Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission...

CVE-2009-4675

CVE-2009-4675 describes a flaw in the Mole Group Gastro Portal (Restaurant Directory) where admin/admin_info/index.php does not require administrative authentication, enabling remote attackers to change the admin password through an unspecified form submission. The NVD CVSS v2 base score is 7.5 (...

CVE-2009-4675

admin/admininfo/index.php in the Mole Group Gastro Portal Restaurant Directory Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission...

Gravity Board X 2.0 Beta (Public Release 3) - SQL Injection

Gravity Board X 2.0 Beta Public Release 3 - SQL Injection !/usr/bin/perl Exploit Title: Gravity Board X 2.0 BETA Public Release 3 SQL INJECTION Date: 26.02.2010 Author: Ctacok Software Link: http://www.gravityboardx.com/ Version: 2.0 BETA Public Release 3 Tested on: Windows SP 3 Code : exploit co...

SphereCMS 1.1 Alpha Blind SQL Injection

www.BugReport.ir AmnPardaz Security Research Team Title: SphereCMS Blind SQL Injection Vulnerability Vendor: http://sphere.xlentprojects.se/ Vulnerable Version: 1.1 alpha Latest version till now Exploitation: Remote with browser Fix: N/A - Description: SphereCMS is a CMS which allow managing foru...

CVE-2010-0638

Cross-site request forgery CSRF vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors. NOTE: the provenance of this information is unknown; the details are obtained solely...

Video Games Rentals Script - SQL Injection

Exploit Title: video games rentals Script SQL injection Vulnerability Date: 11/02/2010 Author: JaMbA Software Link: N/A Version: all version Tested on: Windows & Linux CVE : ::::::::::::::::::::::::: Exploit Title : video games rentals Script SQL injection Vulnerability Author : JaMbA Script Site...

Home Of AlegroCart 1.1 - Cross-Site Request Forgery (Change Administrator Password)

Home Of AlegroCart 1.1 - Cross-Site Request Forgery Change Administrator Password ---------------------------------------------------------------- + Home Of AlegroCart v1.1 - Xsrf Change Administrator Password // Author Info x Author: The.Morpheus x Contact: [email protected] x Thanks:...

PHP Product Catalog Cross Site Request Forgery

Title: PHP Product Catalog - CSRF Change Administrator Password Date: 28/1/2010 Author: bi0 Software Link: http://www.tantumweb.com CVE : /\ == \ /\ \ /\ \ \ \ Admin : Passwd Email : |-------------------------------------------------------------------------------| // End of attack -------...