6489 matches found
mrcgiguy the ticket system 2.0 PHP - Multiple Vulnerabilities
mrcgiguy the ticket system 2.0 PHP - Multiple Vulnerabilities MRCGIGUY The Ticket System 2.0 PHPid Multiple Remote Vulnerabilities Founder: ThE g0bL!N ------ Home: http:/www.4ckx.com/dz/ ---- Vendor:http://www.mrcgiguy.com Special Thx: All Muslims All Members Of Team Algerien Of FootBall Note:...
CVE-2009-1582
CVE-2009-1582 affects Million Dollar Text Links 1.0. The vulnerability allows a remote attacker to bypass access restrictions by directly requesting admin.home.php after visiting admin.php, enabling privilege escalation. The root cause is improper access control around admin.home.php. Public refe...
Server side request forgery (ssrf)
Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to obtain the administrator login name and password via a direct request...
X10Media MP3 Search Engine Admin Access
THUNDER Product: X10media Mp3 Search Engine v1.x Admin Access Vulnerability Author : THUNDER File : admin/admin.php Vulnerable Code / User not an administrator, redirect to main page automatically. / if!$session-isAdmin header"Location: ../main.php"; else / Administrator is viewing page, so displ...
X10Media Mp3 Search Engine 1.x Admin Access Vulnerability
No description provided by source. THUNDER Product: X10media Mp3 Search Engine v1.x Admin Access Vulnerability Author : THUNDER t4hathotmail.fr File : admin/admin.php Vulnerable Code / User not an administrator, redirect to main page automatically. / if!$session-isAdmin header"Location:...
X10Media Mp3 Search Engine < 1.6.2 Admin Access Vulnerability
Exploit for unknown platform in category web applications ============================================================= X10Media Mp3 Search Engine isAdmin header"Location: ../main.php"; else / Administrator is viewing page, so display all forms. / ---------------------------------------- if the...
X10Media Mp3 Search Engine < 1.6.2 Admin Access Vulnerability
No description provided by source. THUNDER Product: X10media Mp3 Search Engine v1.x Admin Access Vulnerability Author : THUNDER t4hathotmail.fr File : admin/admin.php Vulnerable Code / User not an administrator, redirect to main page automatically. / if!$session-isAdmin header"Location:...
X10media Mp3 Search Engine 1.6.2 - Admin Access
X10media Mp3 Search Engine 1.6.2 - Admin Access THUNDER Product: X10media Mp3 Search Engine v1.x Admin Access Vulnerability Author : THUNDER File : admin/admin.php Vulnerable Code / User not an administrator, redirect to main page automatically. / if!$session-isAdmin header"Location: ../main.php"...
X10media Mp3 Search Engine < 1.6.2 - Admin Access
THUNDER Product: X10media Mp3 Search Engine v1.x Admin Access Vulnerability Author : THUNDER File : admin/admin.php Vulnerable Code / User not an administrator, redirect to main page automatically. / if!$session-isAdmin header"Location: ../main.php"; else / Administrator is viewing page, so displ...
Oracle SMB Relay Code Execution
This module will help you to get Administrator access to OS using an unprivileged Oracle database user you need only CONNECT and RESOURCE privileges. To do this you must firstly run smbsniffer or smbrelay module on your sever. Then you must connect to Oracle database and run this module...
DeluxeBB 1.3 - 'qorder' SQL Injection
Author: girex Homepage: girex.altervista.org Date: 18/03/2009 CMS: DeluxeBB 1.3 and prior site: deluxebb.com NOTE: - Works regardless of php.ini settings - This SQL injection will shows you username and md5 of ALL registered users of the site. - This PoC was written for educational purpose. Use i...
YAP 1.1.1 - Blind SQL Injection SQL Injection
YAP 1.1.1 - Blind SQL Injection SQL Injection + YAP 1.1.1 Blind SQL Injection/SQL Injection + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + Blind SQL Injection The default prefix for database tables is "yap" .But can be changed at installation. PoC :...
RoomPHPlanning 1.6 - 'userform.php' Create Admin User
!/usr/bin/perl -w use LWP::UserAgent; use HTML::Form; print "\n"; print "+=RoomPHPlanning\n"; print "+=v1.x\n"; print "+=Vul: Remote Create user with all permissions admin\n"; print "+=Author: Jonathan Salwan \n"; print "+=Web: http://www.shell-storm.org\n"; print "+=Mail: submit AT...
CVE-2008-6411
Explay CMS 2.1 and earlier is affected. The root cause is an authentication bypass achieved by setting the login cookie to 1, enabling a remote attacker to gain administrative access. Documents consistently describe a login-cookie-based bypass leading to full admin rights. Exploitation details ar...
CVE-2008-6292
Acc Autos 4.0 is vulnerable to an authentication bypass where an attacker can gain administrative access by setting three cookies: username_cookie to “admin”, right_cookie to “1”, and id_cookie to “1.” This results in remote access with elevated privileges. No mitigations or patched versions are ...
Graugon Forum v1 (id) SQL Command Injection Exploit
Exploit for unknown platform in category web applications =================================================== Graugon Forum v1 id SQL Command Injection Exploit =================================================== !/usr/bin/perl...
CVE-2009-0412
The ProcessLogin function in class.auth.php in Interspire Shopping Cart ISC 4.0.1 Ultimate edition allows remote attackers to bypass authentication and obtain administrative access by reusing the RememberToken cookie after a failed admin login attempt...
Oracle Forms Cross site Scripting in (iFcgi60.exe / f60servlet)
Oracle Forms Cross site Scripting in iFcgi60.exe / f60servlet About: Oracle Forms is a tool somewhat like Visual Basic in appearance, but the code inside is PL/SQL which allows a developer to quickly create user-interface applications which access an Oracle database in a very efficient and...
SkaLinks 1.5 SQL Injection
Product : SkaLinks Version : 1.5 Dork : Powered by SkaLinks Site: http://www.skalinks.com/ Founded by: Dimi4 Date : 29.01.09 Greetz: antichat SQL-injection, Auth Bypass + URL: http://target.com/skalinks15/admin/ + Admin name : 1' OR 1=1/ Bug Function: function IsAdmin $tablename =...
CVE-2008-5945
Nukeviet 2.0 Beta allows remote attackers to bypass authentication and gain administrative access by setting the admf cookie to 1. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...