Authentication flaw

Install.php in BosDev BosNews 4 and 5 does not require authentication for replacing an existing product installation or creating a new admin account, which allows remote attackers to cause a denial of service overwritten files and possibly obtain administrative access...

CVE-2003-1488

The 1 verifadmin.php and 2 checkadmin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request to admin.php without the connect parameter and with the loggedin parameter set to any value, such as 1...

Arbitrary Command Inclusion

/ hackflatnuke.txt Tested on 2.6 FlatNuke version can work on 3 but it has to be modified With this trick you can steal/modifie a flatnuke account by changing the password and all the profile or change your profile and become an admin Requirements: - You have to know the nickname of the account u...

JBlog 1.0 - 'index.php?id' SQL Injection

Script....................................: JBlog ver 1.0 Script Site...........................: http://www.jmuller.net/jblog/index.php Vulnerability........................: Remote SQL injection Exploit Access..................................: Remote level.........................................

MKPortal 1.01.1 - admin.php Authentication Bypass

MKPortal 1.01.1 - admin.php Authentication Bypass source: https://www.securityfocus.com/bid/25515/info MKPortal is prone to an authentication-bypass vulnerability because it fails to restrict access to certain administrative functions. Attackers can exploit this issue to gain unauthorized access ...

[Full-disclosure] EZPhotoSales 1.9.3 Multiple Vulnerabilities

http://www.airscanner.com/security/07080601ezphotosales.htm Airscanner Mobile Security Advisory 07080601: EZPhotoSales 1.9.3 Multiple Vulnerabilities Product: EZPhotoSales 1.9.3 and below Platform: Windows IIS or Apache with PHP Requirements: Windows IIS or Apache with PHP Credits: Seth Fogie...

Aigaion 1.3.3 - 'topic topic_id' SQL Injection

--==+================================================================================+==-- --==+ Aigaion = 1.3.3 SQL Injection Exploit +==-- --==+================================================================================+==-- DISCOVERED BY: Cody "CypherXero" Rester PAYLOAD: Admin username a...

SuperCali PHP Event Calendar 0.4.0 - SQL Injection

--==+================================================================================+==-- --==+ SuperCali Event Calendar SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

arcade-sql.txt

--==+================================================================================+==-- --==+ Game Portal Manager v1.7 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

ArcadeBuilder Game Portal Manager 1.7 - SQL Injection

--==+================================================================================+==-- --==+ Game Portal Manager v1.7 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

ArcadeBuilder Game Portal Manager 1.7 Remote SQL Injection Vuln

Exploit for unknown platform in category web applications =============================================================== ArcadeBuilder Game Portal Manager 1.7 Remote SQL Injection Vuln ===============================================================...

ArcadeBuilder Game Portal Manager 1.7 Remote SQL Injection Vuln

No description provided by source. --==+================================================================================+==-- --==+ Game Portal Manager v1.7 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZ...

ArcadeBuilder Game Portal Manager 1.7 - SQL Injection

ArcadeBuilder Game Portal Manager 1.7 - SQL Injection --==+================================================================================+==-- --==+ Game Portal Manager v1.7 SQL Injection Vulnerability +==--...

SYM07-011 Symantec Reporting Server password disclosure

SYM07-011: Symantec Reporting Server Password Disclosure June 5, 2007 Risk Impact: Medium Remote Access: Yes Local Access: Yes Authentication Required:Yes Exploit available: No Overview The administrator password for Symantec Reporting Server could be disclosed after a failed login attempt...

Pheap 2.0 - config.php Pheap_Login Authentication Bypass

Pheap 2.0 - config.php PheapLogin Authentication Bypass source: https://www.securityfocus.com/bid/24227/info Pheap is prone to an authentication-bypass vulnerability due to a design error. An attacker can exploit this vulnerability to bypass authentication and execute arbitrary commands in the...

Design/Logic Flaw

AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject a credential variable setting and obtain administrative access via a direct request to admin/changeinfo.php...

CVE-2007-2776

AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject a credential variable setting and obtain administrative access via a direct request to admin/changeinfo.php...

CVE-2007-2775

CVE-2007-2775 affects AlstraSoft Live Support 1.21. The issue arises when the application issues a redirect but does not exit after missing administrative credentials, enabling a remote attacker to obtain administrative access via a direct request to admin/managesettings.php. The NVD description ...

Design/Logic Flaw

ifdate 2.x sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request for the admin/ URI...

qdblog-lfisql.txt

. . . . | . .| . .;/ || Infos --------- Date : 2007-04-12 Product : QDBlog Version : v0.4 - Prior version maybe also be affected Vendor : http://sourceforge.net/projects/qdblog/ Vendor Status : 2007-04-12 - Not Informed! Description : QDBlog is an open-source, simple, minimalistic blogging...