Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Exinda WAN Optimization Suite 7.0.0 2160 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to admin/launch...

CVE-2014-7158

Cross-site request forgery CSRF vulnerability in Exinda WAN Optimization Suite 7.0.0 2160 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to admin/launch...

Travel Portal II 6.0 Cross Site Request Forgery

Travel Portal II 6.0 - CSRF Admin Password Change PoC Exploit My + Author : KnocKout Contactonlymail : [email protected] HomePage : http://Cyber-Warrior.Org - http://h4x0resec.blogspot.com - http://www.cyber-warrior.org/100379 Greetz:...

建站之星Sitestar设计缺陷可CSRF修改管理员密码

简要描述： 没有技术含量的洞。！ 详细说明： WooYun: 建站之星敏感功能csrf 可dump数据库 对于这个洞中厂商的回复感觉坑爹，再来一处CSRF提醒下厂商。 强烈建议查下CSRF的介绍。 /admin/index.php?m=moduser&a=adminupdate&userid=1&passwdpasswd=123123&passwdrepasswd=123123&[email protected]&useractive=1&usersrole=admin&userfullname=&usermobile=&submit=%E4%BF%9D%E5%AD%98...

Design/Logic Flaw

IBM Scale Out Network Attached Storage SONAS 1.3.x and 1.4.x before 1.4.3.3 places an administrative password in the shell history upon use of the -p option to chuser, which allows local users to obtain sensitive information by leveraging root access...

SuperMicro IPMI 4 9 1 5 2 port password leak vulnerability-vulnerability warning-the black bar safety net

2014.06.20 SuperMicro IPMI 4 9 1 5 2 port password leak vulnerability is the foreign media communications http://arstechnica.com/security/2014/06/at-least-32000-servers-broadcast-admin-passwords-in-the-clear-advisory-warns/）,the spirit of the vulnerability of the curious, this article on the...

YidaCms_X3.2逻辑错误造成越权访问,可修改管理密码

简要描述： 因代码逻辑错误,可以构造语句绕过,直接修改管理员密码 详细说明： 最新版的3.2下的 admin\CheckAdmin.asp username = request.Cookies"username" password = request.Cookies"password" cookiesmd5 = request.Cookies"cookiesmd5" dim adminname,adminpass,adminqx,adminaqx set rs = server.createobject"adodb.recordset" sql="select from...

Huawei HG866 Authentication Bypass

No description provided by source. Exploit Title: Huawei HG866 Authentication Bypass Date: Jun 14 2012 Exploit Author: hkm Vendor Homepage: http://www.huawei.com Version: V1R2C01SPC202, R3.2.4.92sbn - R3.4.2.257sbn, 3FE53864AOCB16 Tested on: HG866GTAVER.C, 01, 02 Advisory:...

DaloRadius - Multiple Vulnerabilities

No description provided by source. ------------------------------------------------------------------------- Software : DaloRadius SQLi / CSRF / XSS Author : Saadat Ullah , [email protected] Author home : http://security-geeks.blogspot.com Date : 15/3/13 Vendors : http://www.daloradius.co...

FaScript FaPhoto 1.0 - (show.php id) SQL Injection Vulnerability

No description provided by source. AUTHOR : IRCRASH Dr.Crash Script Download : http://en.fascript.com/en.faphoto.zip Injection Adress : http://Sitename/faname/show.php?id=SqL Code Help : In This Script Admin Username and Password Save in ./admin/pconfig.php You can open this file with loadfile...

Magic News Plus <= 1.0.3 Admin Pass Change Exploit

No description provided by source. !/usr/bin/perl Magic News Plus =1.0.3 Admin Pass Change Exploit Copyright c 2006 cijfer [email protected] All rights reserved. An input validation flaw exists within 'settings.php' of Magic News Plus which can lead to the changing of the administrative password...

Ez Guestbook 1.0 - Multiple Vulnerabilities

No description provided by source. ------------------------------------------------------------------------------------------------- Title: Ez Guestbook 1.0 Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 14. December 2009...

Kloxo - SQL Injection and Remote Code Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper Ran...

AlstraSoft Template Seller Pro <= 3.25 Admin Password Change Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo AlstraSoft Template Seller Pro = 3.25 Admin Password Change Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love ; if $argc4 echo Usage: php...

Kleeja Upload - CSRF Change Admin Password

No description provided by source. Exploit Title: Kleeja Upload - CSRF Change Admin Password Date: 11-08-2010 Author: KOLTN & [email protected] Software Link: http://www.kleeja.com Software Download: http://www.kleeja.com/download/ Type : CSRF Version: all Version Greetz to : Juba & Mushii Exploi...

Softbiz Banner Exchange Network Script 1.0 - SQL Injection Vulnerability

Softbiz Banner Exchange Network Script ver 1 SQL INJECTION BY IRCRASH AUTHOR : IRCRASH Dr.Crash Script Download : http://www.softbizscripts.com/ Injection Adress : http://sitename/campaignstats.php?id=SQL C0de SQL C0de :...

IPNPro3 <= 1.44 - Admin Password Changing Exploit

No description provided by source. ?php / ============================================================================== / \ | | | | / \ | | | | / \ | | | | / \ | || | / \ | | | | / \ | | IN THE NAME OF // \ || || // \ || ||...

PNphpBB2 <= 1.2 - (index.php c) Remote SQL Injection Exploit

No description provided by source. ?/ Exploit Name: PNphpBB2 = 1.2 Remote SQL Injection Exploit Autor: Kacper Contact: [email protected] Homepage: http://www.rahim.webd.pl/ Kacper Hacking & Security Blog: http://kacper.bblog.pl/ Irc: irc.milw0rm.com:6667 devilteam Pozdro dla wszystkich z kanalu...

DD-WRT v24-sp1 - (CSRF) Cross Site Reference Forgery Exploit

No description provided by source. Remote root dd-wrt -------------------------------------------------------------------------------- Written by Michael Brooks Special thanks to str0ke Exploits tested on the newist stable version: Firmware: DD-WRT v24-sp1 07/27/08 micro Product Homepage:...

CMtextS <= 1.0 (users_logins/admin.txt) Credentials Disclosure Vuln

No description provided by source. ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:+ +:+:+ +:+ ++...