CVE-2011-4214

CVE-2011-4214 concerns OneOrZero Action & Information Management System (AIMS) v2.7.0. The vulnerability is an authentication bypass : a crafted oozimsrememberme cookie allows remote attackers to obtain administrator privileges . Affected software: AIMS 2.7.0. Underlying issue: bypassing authenti...

CVE-2011-4215

SQL injection vulnerability in lib/oozaccess.php in OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to execute arbitrary SQL commands via the cookieName variable...

CVE-2011-4214

OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie...

CVE-2011-4214: Improper Authentication

OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie...

CVE-2011-4215: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lib/oozaccess.php in OneOrZero Action & Information Management System AIMS 2.7.0 allows remote attackers to execute arbitrary SQL commands via the cookieName variable...

OneOrZero AIMS Security Bypass and SQL Injection Vulnerabilities

OneOrZero AIMS is prone to a security-bypass vulnerability and an SQL- injection vulnerability. An attacker can exploit these issues to bypass certain security restrictions, perform unauthorized actions, bypass filtering, and modify the logic of SQL queries. OneOrZero AIMS 2.7.0 is affected; othe...

OneOrZero AIMS Security Bypass and SQLi Vulnerabilities

OneOrZero AIMS is prone to a security bypass vulnerability and an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

OneOrZero AIMS authentication bypass and SQLi vulnerabilities

Overview OneOrZero Action & Information Management System AIMS is vulnerable to an authentication bypass and SQL injection. Description According to the vendor's website:"OneOrZero AIMS is a powerful enterprise ready suite that includes a help desk, knowledge base, time manager and reporting syst...

CVE-2010-4835

Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users to read arbitrary files via directory traversal sequences in the controller parameter in a showreport action...

CVE-2010-4834

Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users to execute arbitrary SQL commands via the 1 id parameter in a savedsearch action and 2 itemtypes parameter in a showitemsearch action in the...

CVE-2010-4835

Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users to read arbitrary files via directory traversal sequences in the controller parameter in a showreport action...

CVE-2010-4834

Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users to execute arbitrary SQL commands via the 1 id parameter in a savedsearch action and 2 itemtypes parameter in a showitemsearch action in the...

CVE-2010-4834

The CVE-2010-4834 entry describes multiple SQL injection flaws in index.php for OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition. The vulnerabilities reside in the search_management_manage subcontroller, where remote authenticated users can manipulate the (1) id parameter in a saved_s...

CVE-2010-4835

CVE-2010-4835 is a directory traversal vulnerability in OneOrZero AIMS 2.6.0 Members Edition. The flaw resides in index.php, where the controller parameter in a show_report action can be manipulated to read arbitrary files. This is a vulnerability in the web application that could allow remote au...

CVE-2010-4834: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in OneOrZero AIMS 2.6.0 Members Edition and 2.7.0 Trial Edition allow remote authenticated users to execute arbitrary SQL commands via the 1 id parameter in a savedsearch action and 2 itemtypes parameter in a showitemsearch action in the...

CVE-2010-4835: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in OneOrZero AIMS 2.6.0 Members Edition allows remote authenticated users to read arbitrary files via directory traversal sequences in the controller parameter in a showreport action...

PT-2011-21: SQL injection vulnerability in OneOrZero AIMS

Positive Research Center has discovered multiply SQL injection vulnerabilities in OneOrZero AIMS. Application incorrectly validates input data. That allows attackers to conduct SQL injection attack. "SQL Injection" is a way to bypass network protection and attack the database. Settings transferre...

PT-2011-20: Authorization bypass vulnerability in OneOrZero AIMS

Positive Research Center has discovered authorization bypass vulnerability in OneOrZero AIMS. Vulnerability exists due incorrect logic of authorization using $COOKIE variables - predictable session value, stored in $COOKIE'oozimsrememberme' variable. Attacker, have valid username which registered...

OneOrZero AIMS v2.6.0 Members Edition Multiple Vulnerabilities

Exploit for php platform in category web applications ============================================================== OneOrZero AIMS v2.6.0 Members Edition Multiple Vulnerabilities ============================================================== :::::::::::::::::::::::::::::::::::::: 0x1...

OneOrZero AIMS 2.6.0 Members Edition Local File Inclusion / SQL Injection

Exploit Title: OneOrZero AIMS v2.6.0 Members Edition Multiple Vulnerabilities Date: 13.11.2010 Author: Valentin Category: webapps/0day Version: 2.6.0 Tested on: CVE : Code : :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: General Information Advisory/Exploit Titl...