Design/Logic Flaw

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

CVE-2007-6487

Unspecified vulnerability in Plain Black WebGUI 7.4.0 through 7.4.17 allows remote authenticated users with Secondary Admin privileges to create Admin accounts, a different vulnerability than CVE-2006-0680...

Authentication flaw

adduser.php in PHP-AGTC Membership AGTC-Membership System 1.1a does not require authentication, which allows remote attackers to create accounts via a modified form, as demonstrated by an account with admin userlevel 4 privileges...

CVE-2007-5032

Cross-site request forgery CSRF vulnerability in admin.php in Francisco Burzi PHP-Nuke allows remote attackers to add administrative accounts via an AddAuthor action with modified addname and addradminsuper parameters...

Buddy Zone 1.5 (view_sub_cat.php cat_id) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Buddy Zone 1.5 viewsubcat.php catid SQL Injection Vulnerability ====================================================================...

Design/Logic Flaw

Geckovich TaskTracker Pro 1.5 and earlier allows remote attackers to add administrative or other accounts via an Add action with a modified GroupID in a direct request to Customize.asp...

Symantec Sygate Management Server (login) SQL Injection Exploit

Exploit for cgi platform in category web applications =============================================================== Symantec Sygate Management Server login SQL Injection Exploit =============================================================== This file is part of the Metasploit Framework and may...

atutor-151.txt

ATUTOR 1.5.1 possibly prior versions SQL INJECTION / ADMIN & USERS CREDENTIALS DISCLOSURE / INFORMATION DISCLOSURE / USER IMPERSONATION / REMOTE CODE EXECUTION software: site: http://www.atutor.ca/ description: "ATutor is an Open Source Web-based Learning Content Management System LCMS designed...

List of all admin accounts in phpBB

After discovering 'highlight' vulnerability in phpBB, many forums were patched, but... it is possible that attackers created a secret admin accounts... It is very hard to find secret admin accounts if the forum has too many users... you must check every account... So, here is a simple PHP script,...

ubpbbs.txt

product: Ultimate PHP Board UPB version: Public Beta 1.0b !!FIXED vendor: http://www.webrc.ca/php/upb.php status: notified ------------------------------------------------ summary: upb allow to have two admin' accounts, but witn different access levels. its may aply with spoofing attacks...

PHP-Nuke v5.6 - Users can compromise admin accts.

Tested on PHP-Nuke v5.6 with Mozilla on Linux should work on past versions and on most browsers Impact: --------------------------------------------- Allows any user to get admin access to a PHP-Nuke site. Summary: ---------------------------------------------- Due to a XSS flaw in PHPNuke's...

MS SQL 7.0 DTS saved packages contain plain text passwords

When creating a Data Transformation Service DTS Package be carefull. The saved file does not encrypt the passwords that the package will use when executed. If a client could convice an admin to create an example DTS package for troubleshooting then the client would have the admin's SQL password. ...