MyioSoft Ajax Portal 3.0 - page SQL Injection

MyioSoft Ajax Portal 3.0 - page SQL Injection AjaxPortal 3.0 ajaxpbackend.php page Remote SQL Injection Vulnerability Bug found && Exploited by cOndemned Greetz: ZaBeaTy, d2, Beowulf, str0ke, Alfons Luja, 0in and others Proof of Concept :...

MyioSoft Ajax Portal 3.0 (page) SQL Injection Vulnerability

Exploit for unknown platform in category web applications =========================================================== MyioSoft Ajax Portal 3.0 page SQL Injection Vulnerability =========================================================== AjaxPortal 3.0 ajaxpbackend.php page Remote SQL Injection...

Cpanel File Manager Cross Site Scripting

Cpanel File Manager XSS Vulnerability Synopsis ------------- Cpanel www.cpanel.net has two file manager application, standard and legacy one to manage files. Both of them are vulnerable to XSS attack. File name is presented unescaped so that an attacker can craft malicious file name to execute...

SA-CONTRIB-2009-010 Plus 1 - Cross-site request forgery

The Plus 1 module provides a voting widget for content that records votes using Ajax. The URL for voting is vulnerable to cross-site request forgeries CSRF making it possible for users to unknowingly vote for content. Versions affected Versions of Plus 1 prior to 6.x-2.6 Drupal core is not...

phpcms2008-0day ask/search_ajax.php注入漏洞

漏洞文件：ask/searchajax.php ?php require './include/common.inc.php'; requireonce MODROOT.'include/ask.class.php'; $ask = new ask; header'Content-type: text/html; charset=utf-8'; ifstrtolowerCHARSET != 'utf-8' $q = iconvCHARSET, 'utf-8', $q; if$q $where = " title LIKE '%$q%' AND status = 5"; else...

马克斯CMS2.0beta (maxcms)管理员认证绕过漏洞

maxcms后台有自动升级功能，ajax的那个注射被修补了，但是这个漏洞还是没有修补。在上一贴有同学问是否能绕过认证，答案是肯定的，但是前提是要知道后台目录地址 Sub checkPower dim loginValidate,rsObj : loginValidate = "maxcms2.0" err.clear on error resume next set rsObj=conn.db"select mrandom,mlevel from premanager where musername='"&rCookie"musername"&"'","execute"...

Max CMS2. 0beta (maxcms)administrator authentication bypass vulnerability-vulnerability warning-the black bar safety net

by flyh4t http://bbs.wolvez.org/ maxcms background have auto upgrade function, the ajax that the injection is patched, but the vulnerability still not patched. In the previous patch with classmates to see if they can bypass the authentication, the answer is Yes, but the premise is to know the...

CVE-2009-0468

The CVE-2009-0468 entry describes multiple CSRF vulnerabilities in Profense Web Application Firewall (ajax.html) affecting version 2.6.2 and 2.6.3. An attacker could hijack administrator sessions to perform actions such as (1) shutdown the server, (2) ping packets, (3) enable network services, (4...

Sql injection

Multiple SQL injection vulnerabilities in the ajaxchecklistsave function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "update ajax checklists" permissions, to execute arbitrary SQL commands via a save operation, related to the 1 nid, 2 qid, and...

Cross site scripting

Cross-site scripting XSS vulnerability in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allows remote authenticated users, with create and edit permissions for posts, to inject arbitrary web script or HTML via unspecified vectors involving the ajaxchecklist filter...

CVE-2008-5999

Cross-site scripting XSS vulnerability in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allows remote authenticated users, with create and edit permissions for posts, to inject arbitrary web script or HTML via unspecified vectors involving the ajaxchecklist filter...

CVE-2008-5998

Multiple SQL injection vulnerabilities in the ajaxchecklistsave function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "update ajax checklists" permissions, to execute arbitrary SQL commands via a save operation, related to the 1 nid, 2 qid, and...

CVE-2008-5999

CVE-2008-5999: In Drupal’s Ajax Checklist module (5.x) versions before 5.x-1.1, a cross-site scripting (XSS) vulnerability exists. Remote authenticated users with create/edit permissions for posts can inject arbitrary script/HTML via the ajax_checklist filter. Affected component is the Drupal Aja...

CVE-2008-5998

CVE-2008-5998 describes multiple SQL injection vulnerabilities in the Ajax Checklist module for Drupal (5.x before 5.x-1.1). The flaws allow remote authenticated users, with the update ajax checklists permission, to execute arbitrary SQL commands via a save operation, with the vulnerability tied ...

CVE-2008-5998

Multiple SQL injection vulnerabilities in the ajaxchecklistsave function in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allow remote authenticated users, with "update ajax checklists" permissions, to execute arbitrary SQL commands via a save operation, related to the 1 nid, 2 qid, and...

CVE-2008-5999

Cross-site scripting XSS vulnerability in the Ajax Checklist module 5.x before 5.x-1.1 for Drupal allows remote authenticated users, with create and edit permissions for posts, to inject arbitrary web script or HTML via unspecified vectors involving the ajaxchecklist filter...

opera9. 5 2 Use ajax to read a local file vulnerability further use-vulnerability warning-the black bar safety net

by emptiness prodigal heart http://www.inbreak.net The foregoing the opera9. 5 2 Use ajax to read a local file vulnerability on , Referred to the opera's ajax to read a local file vulnerability. But the use of the way, relatively narrow. Very few people will download the htm file locally, then op...

opera 9.52 using ajax to read a local file vulnerability-vulnerability warning-the black bar safety net

by emptiness prodigal heart This may also be a safety feature right, opera can use ajax to read a local file. ff3 does not have this vulnerability. Not nonsense, look at the code. Use as follows: This piece of code saved as a local htm file, and then use opera to open. Will put a local user name...

DSA-1692-1 php-xajax - cross-site scripting

Bulletin has no description...

Google Analytics Stored Cross Site Scripting

====================================================== ================= = Google Analytics - Stored Cross Site Scripting Vulnerability = = Vendor Website: = http://www.google.com = = Affected Version: = -- http://www.google.com/analytics/ = = Public disclosure on 8th December 2008 =...