CVE-2007-3587

MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settings.php that injects PHP code into settings.inc, which can then be executed via a direct request to index.php...

phpfaber-include.txt

phpFaber TopSites v.3index.phpRemote File Disclosure Vulnerability D.Script: http://www.phpfaber.com/cmscontent/files/phpfabertopsites.zip Discovered by: Dr.RoVeR --Arab48 Hacker [email protected] Greetz To: Tryag Team You have to be admin to run the script :D V.Code: if !$GET'page' ||...

CVE-2007-1725

SQL injection vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to execute arbitrary SQL commands via the filename of an uploaded file to the avatar function, as demonstrated by setting admin privileges...

CVE-2007-1471

admin/default.asp in Orion-Blog 2.0 allows remote attackers to bypass authentication controls and gain privileges via a direct URL request for admin/AdminBlogNewsEdit.asp...

Nessus Windows Scan Not Performed with Admin Privileges

The Nessus scanner testing the remote host has been given SMB credentials to log into the remote host, however these credentials do not have administrative privileges. Typically, when Nessus performs a patch audit, it logs into the remote host and reads the version of the DLLs on the remote host ...

CVE-2007-1187

WebAPP before 0.9.9.5 allows remote authenticated users, without admin privileges, to obtain sensitive information via 1 the Forum Archive feature and 2 Recent Searches...

vBulletin 3.6.4 - inlinemod.php?postids SQL Injection

vBulletin 3.6.4 - inlinemod.php?postids SQL Injection input-cleanarraygpc'p', array 'postids' = TYPESTR, ; $postids = exp...

CVE-2006-7016

phpjobboard allows remote attackers to bypass authentication and gain administrator privileges via a direct request to admin.php with adminop=job-edit...

CVE-2006-7016

phpjobboard allows remote attackers to bypass authentication and gain administrator privileges via a direct request to admin.php with adminop=job-edit...

Design/Logic Flaw

The dologin function in guestbook.php in KvGuestbook 1.0 Beta allows remote attackers to gain administrative privileges, probably via modified $mysql'pass' and $gbpass variables...

The use of ASP Trojan horse program to obtain administrative privileges-bug warning-the black bar safety net

Some time ago the proliferation of dynamic network Forum upload vulnerability and the recent spate of a variety of asp systems exposed upload vulnerability, may be a lot of friends hands with a lot of webshell broiler, as choose how these Chicks are also vary from person to person, someone to...

dc-sql.txt

/ -061124a- \ | deV!Lz Clanportal - SQL Injection | \ / S Y N O P S I S / =================' - access: remote severity: high - An SQL injection has been found in deV!Lz Clanportal, which allows any logged in user to grant herself admin privileges in the system. B A C K G R O U N D /...

CVE-2006-5980

admlgnadmin.asp in Renasoft NetJetServer 2.5.3.939, and possibly earlier, does not properly perform login authentication, which allows remote attackers to obtain administrative privileges. NOTE: the provenance of this information is unknown; details are obtained from third party sources...

UNISOR-cms.txt

Tunis the 26/10/2006 bug found by fireboy product:UNISOR CMS vendor:www.unisor.nl there is an sql injection problem in UNISOR CMS login page and it can be exploited to gain admin privileges. exploit: user: 'or''=' pass: 'or''=' example:http://www.target.com/unisor/login.asp thx...

UNISOR CMS sql injection

Tunis the 26/10/2006 bug found by fireboy product:UNISOR CMS vendor:www.unisor.nl there is an sql injection problem in UNISOR CMS login page and it can be exploited to gain admin privileges. exploit: user: 'or''=' pass: 'or''=' example:http://www.target.com/unisor/login.asp thx...

KICS-cms.txt

Tunis the 18/10/2006 bug found by fireboy product:KICS CMS vendor:http://www.kinesis.com.au/ there is an sql injection problem in KICS CMS login page and it can be exploited to gain admin privileges. exploit: user: 'or''=' pass: 'or''=' example:http://www.target.com/kicscms/index.asp thx...

UltraCMS-0.9.txt

Tunis the 18 October 2006 bug found by fireboy product:UltraCMS 0.9 there is an sql injection problem in UltraCMS 0.9 and it can be exploited to gain admin privileges. exploit: user: 'or''=' pass: 'or''=' example : http://www.target.com/include/index.php thx...

KICS CMS sql injection

Tunis the 18/10/2006 bug found by fireboy product:KICS CMS vendor:http://www.kinesis.com.au/ there is an sql injection problem in KICS CMS login page and it can be exploited to gain admin privileges. exploit: user: 'or''=' pass: 'or''=' example:http://www.target.com/kicscms/index.asp thx...

UltraCMS 0.9 sql injection

Tunis the 18 October 2006 bug found by fireboy product:UltraCMS 0.9 there is an sql injection problem in UltraCMS 0.9 and it can be exploited to gain admin privileges. exploit: user: 'or''=' pass: 'or''=' example : http://www.target.com/include/index.php thx...

CVE-2006-5288

The CVE-2006-5288 issue involves Cisco 2700 Series Wireless Location Appliances with a default administrator credential set: username root and password password (pre-2.1.34.0). Remote attackers could obtain administrative privileges due to this default credential configuration (Bug ID CSCsb92893)...