Symantec Scan Engine 5.0.x.x Change Admin Password Remote Exploit

Exploit for cgi platform in category remote exploits ================================================================= Symantec Scan Engine 5.0.x.x Change Admin Password Remote Exploit ================================================================= !/usr/bin/perl -w Remotely change the...

1 1 4 Forum 2 0 0 5 The official version of the vulnerability-vulnerability warning-the black bar safety net

Keywords: "ALL RIGHTS RESERVED design and production: Web 1 1 4" Vulnerability description: Site 1 1 4 Forum 2 0 0 5 version of the official /edituserdb. asp To submit data and cooikes lack of validation Cause any user can modify the administrator password The default background admin/index. asp...

phpBB 2.0.19 - 'user_sig_bbcode_uid' Remote Code Execution

!/usr/bin/perl r57phpbba2e2.pl - phpBB admin 2 exec exploit version 2 based on usersigbbcodeuid bug tested on 2.0.12 , 2.0.13 , 2.0.19 -------------------------------------------- screen r57phpbba2e2.pl -u http://192.168.0.2/phpBB-2.0.19/ -L admin -P password Command for execute or 'exit' for exi...

Crafty Syntax Image Gallery 3.1g - Remote Code Execution

!/usr/bin/perl This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at your option any later version. This program is distributed in the hope that...

Crafty Syntax Image Gallery <= 3.1g Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at your option any later version. This...

CVE-2006-1541

SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter...

Sql injection

SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter...

CVE-2006-1541

SQL injection in EzASPSite 2.0 RC3 and earlier (Default.asp) allows remote attackers to run arbitrary SQL and obtain the admin password SHA1 hash via the Scheme parameter. Connected documents do not add further technical details or mitigations in this set; no exploit status provided.

CVE-2006-1541

SQL injection vulnerability in Default.asp in EzASPSite 2.0 RC3 and earlier allows remote attackers to execute arbitrary SQL commands and obtain the SHA1 hash of the admin password via the Scheme parameter...

Improper access control

TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd...

CVE-2006-1412

TFT Gallery 0.10 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the admin password file and obtain password hashes via a direct request to admin/passwd...

PHPCollab 2.x NetOffice 2.x - sendpassword.php SQL Injection

PHPCollab 2.x NetOffice 2.x - sendpassword.php SQL Injection !/usr/bin/php -q -d shortopentag=on works with magicquotesgpc = Off\r\n\r\n"; echo "a googledork: intitle:phpcollab|netoffice "index of" -www-apps -php-collab.org -ext:xml\r\n\r\n"; if $argc4 echo "Usage: php ".$argv0." host path email...

SPIP < 1.8.2-g SQL Injection and XSS Flaws

The remote web server has a PHP application that is affected by multiple flaws. Description: The remote host is running SPIP, an open-source CMS written in PHP. The remote version of this software is prone to SQL injection and cross site scripting attacks. An attacker could send specially crafted...

TFT Gallery 0.10 - Password Disclosure

!/usr/bin/perl Copyright C undefined1 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or at your option any later version. This program is...

Advisory-20.txt

/ -------------------------------------------------------- Neo Security Team NST� - Advisory 20 - 04/03/06 -------------------------------------------------------- Program: Pixel Post Homepage: http://photoblogger.halof.de/ Vulnerable Versions: 3.0 and lower versions. Risk: High! Impact: Critical...

CVE-2006-0843

Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password...

[HSC Security Group] Multiple SQL injection/XSS in SimpleBlog 2.1

Hackers Center Security Group http://www.hackerscenter.com/ Zinho's Security Advisory Risk: High - Note from the author Simple Blog is a free weblog application intended for personal use. The latest version, 2.1, features xhtml/css template structure, rss feed, blog calendar and an easy to use...

cijfer-mnxpl.pl.txt

!/usr/bin/perl Magic News Plus All rights reserved. An input validation flaw exists within 'settings.php' of Magic News Plus which can lead to the changing of the administrative password. Here is where the problem is line 108 of 426: ... 1 elseif $action == "change" ... 2 if $passwd !=...

Magic News Plus 1.0.3 - Admin Pass Change

!/usr/bin/perl Magic News Plus All rights reserved. An input validation flaw exists within 'settings.php' of Magic News Plus which can lead to the changing of the administrative password. Here is where the problem is line 108 of 426: ... 1 elseif $action == "change" ... 2 if $passwd !=...

[eVuln] PHPjournaler SQL Injection Vulnerability

New eVuln Advisory: PHPjournaler SQL Injection Vulnerability --------------------Summary---------------- Software: PHPjournaler Versions: 1.0 Critical Level: Moderate Type: SQL Injection Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered by: Aliaksandr Hartsuyeu...