Bizon-CMS 'photo/index.php' SQL注入漏洞

BUGTRAQ ID: 29770 CNCAN ID：CNCAN-2008061902 Bizon-CMS是一款基于PHP的WEB应用程序。 Bizon-CMS不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题是'photo/index.php'脚本对用户提交给'id'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Bizon-Soft Development Laboratory Bizon-CMS 2.0 漏洞提供者 Mr.SQL [email protected]...

CVE-2008-2761

Multiple cross-site scripting XSS vulnerabilities in Xigla Absolute Banner Manager XE 2.0 allow remote authenticated administrators to inject arbitrary web script or HTML via the text parameter in 1 searchbanners.asp and 2 listadvertisers.asp, and other unspecified fields. NOTE: some of these...

CVE-2008-2760

SQL injection vulnerability in searchbanners.asp in Xigla Absolute Banner Manager XE 2.0 allows remote authenticated administrators to execute arbitrary SQL commands via the orderby parameter...

CVE-2008-2758

The CVE-2008-2758 entry concerns Xigla Absolute News Manager XE 3.2 with multiple XSS vulnerabilities . According to the records, remote authenticated administrators can inject arbitrary script or HTML via parameters in admin/search.asp (pblname, text), admin/publishers.asp (name), and other vect...

Bizon-CMS 2.0 (index.php Id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications =============================================================== Bizon-CMS 2.0 index.php Id Remote SQL Injection Vulnerability =============================================================== Viva IslaM Viva IslaM Remote SQL Injection...

Bizon-CMS 2.0 - Id SQL Injection

Bizon-CMS 2.0 - Id SQL Injection Viva IslaM Viva IslaM Remote SQL Injection Vulnerability Bizon-CMS V2.0 index.php Page AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM Email : [email protected] !! SYRIAN HaCkErS !! Script : Bizon-CMS version : V2.0 site : www.bizon-soft.com -:: SQL ::- www.site.com/photo/...

DEBIAN-CVE-2008-2392

Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard...

Joovili 3.1 (browse.videos.php category) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Joovili 3.1 browse.videos.php category SQL Injection Vulnerability ==================================================================== -Joovili- Rem0te SQL Injection...

Joovili 3.1 - browse.videos.php SQL Injection

Joovili 3.1 - browse.videos.php SQL Injection -Joovili- Rem0te SQL Injection Vulnerability IN == browse.videos.php Author: HaCkeR-EgY H^0mE: WWW.PAL-HACKER.COM , ATSDP.COM CONTact: [email protected] ================================================ Script : Joovili version : Version 3.1.0 pric...

Simple Machines Forum "SMF Shoutbox" Mod Persistent XSS

Simple Machines Forum "SMF Shoutbox" Mod 1.16b-1.14 Reference: http://custom.simplemachines.org/mods/index.php?mod=412 Bug:Persistent XSS SMF Shoutbox is a popular shoutbox mod for Simple Machines Forum.The content of a post variable used to hold the user shout is stored in the database and then...

Bigware Shop 2.0 pollid Remote SQL Injection Vulnerability

No description provided by source. Bigware Shop 2.0 Bug found by D4m14n Vendor: http://www.bigware.de/ Vuln. Version: 2.0 prior versions also may be affected Email: [email protected] GoogleDork: "Diese Shopsoftware wurde entwickelt von Bigware" There's a SQL-Injection in...

bigware-sql.txt

Bigware Shop 2.0 Bug found by D4m14n Vendor: http://www.bigware.de/ Vuln. Version: 2.0 prior versions also may be affected Email: [email protected] GoogleDork: "Diese Shopsoftware wurde entwickelt von Bigware" There's a SQL-Injection in "mainbigware53.tpl.php"! You can find more than this...

Bigware Shop 2.0 - pollid SQL Injection

Bigware Shop 2.0 - pollid SQL Injection Bigware Shop 2.0 Bug found by D4m14n Vendor: http://www.bigware.de/ Vuln. Version: 2.0 prior versions also may be affected Email: [email protected] GoogleDork: "Diese Shopsoftware wurde entwickelt von Bigware" There's a SQL-Injection in...

Bigware Shop 2.0 - 'pollid' SQL Injection

Bigware Shop 2.0 Bug found by D4m14n Vendor: http://www.bigware.de/ Vuln. Version: 2.0 prior versions also may be affected Email: [email protected] GoogleDork: "Diese Shopsoftware wurde entwickelt von Bigware" There's a SQL-Injection in "mainbigware53.tpl.php"! You can find more than this...

Invision Power Board (IP.Board) 2.1.7 - 'ACTIVE' Cross-Site Scripting / SQL Injection

---- INVISION POWER BOARD 2.1.7 EXPLOIT ... ITDefence.ru Antichat.ru INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007 ////...

MailMachine Pro 2.2.4 Remote SQL Injection Vulnerability

No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / &nb...

RunCMS 1.6 Get Admin Cookie Remote Blind SQL Injection Exploit

No description provided by source. // / RUNCMS 1.6 BLIND SQL Injection Exploit get Admin Cookie / // / exploit get admin cookie that can be used / / to login by pasting it into browser Opera / / and then get access to Admin session / / and change Admins password / / / // // / tested on RUNCMS...

jPORTAL <= 2.3.1 articles.php Remote SQL Injection Vulnerability

No description provided by source. Title:jPORTAL = 2.3.1 and Remote SQL Injection Vulnerability Dork: intext:"jPORTAL 2" & inurl:"articles.php?topic=" Autor: Alexsize E-Mail: [email protected] Site: Antichat.ru articles.php?topic=-3+union+select+1,pass,3,4,5+from+admins/ Vuln code: function...

jportal2-sql.txt

Tytul: jPORTAL 2 Remote SQL Injection Vulnerability dork: intext:"jPORTAL 2" & inurl:"mailer.php" Autor: Kacper E-Mail: [email protected] Strona: devilteam.eu Irc: irc.myg0t.com devilteam Blad: mailer.php?to=999999999999'+union+select+0,1,2,3,4,5,concatnick,char58,pass,7+from+admins+limit+1/ po...

jPORTAL 2 mailer.php Remote SQL Injection Vulnerability

No description provided by source. Tytul: jPORTAL 2 Remote SQL Injection Vulnerability dork: intext:"jPORTAL 2" & inurl:"mailer.php" Autor: Kacper E-Mail: [email protected] Strona: devilteam.eu Irc: irc.myg0t.com devilteam Blad:...