alstrasoft-multi.txt

AlstraSoft Multiple products multiple Vulnerabilities Vendor urL:http://www.alstrasoft.com/products.htm Advisore url:http://lostmon.blogspot.com/2007/07/ alstrasoft-multiple-products-multiple.html Vendor notify:yes webform Exploit included: yes Multiple products of Alstrasoft Are prone vulnerable...

Alstrasoft Affiliate Network Pro 8.0 - 'index.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/25026/info AlstraSoft Affiliate Network Pro is affected by multiple input-validation vulnerabilities. These issues include multiple cross-site scripting isues and SQL-injection issues. A successful exploit could allow an attacker to compromise the...

Alstrasoft Affiliate Network Pro 8.0 - 'pgmid' SQL Injection

source: https://www.securityfocus.com/bid/25026/info AlstraSoft Affiliate Network Pro is affected by multiple input-validation vulnerabilities. These issues include multiple cross-site scripting isues and SQL-injection issues. A successful exploit could allow an attacker to compromise the...

AlstraSoft E-Friends Pack SQL注入漏洞

AlstraSoft E-Friends是一款基于PHP的WEB应用程序。 AlstraSoft E-Friends不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息。 问题是脚本对用户提交的'pack'参数缺少过滤，提交恶意SQL代码作为参数数据，可导致更改原来的SQL逻辑，获得敏感信息。 AlstraSoft E-Friends 4.0 AlstraSoft E-Friends 4.21 目前没有解决方案提供： http://www.alstrasoft.com/efriends.htm !/usr/bin/php -q -d...

AlstraSoft Live Support Managesettings.PHP密码泄露漏洞

AlstraSoft Live Support是一款基于PHP的WEB应用程序。 AlstraSoft Live Support脚本不正确过滤用户提交的输入，远程攻击者可以利用漏洞获得敏感信息。 问题是'managesettings.php'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL代码作为参数数据，可导致更改原来的SQL逻辑，获得敏感信息。 AlstraSoft Live Support 1.21 目前没有解决方案提供： http://www.alstrasoft.com/livesupport.htm...

Sql injection

SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameter in a paypal action for index.php...

CVE-2007-2824

SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameter in a paypal action for index.php...

CVE-2007-2824

SQL injection vulnerability in paypal.php in AlstraSoft E-Friends 4.21 and earlier allows remote attackers to execute arbitrary SQL commands via the pack parameter in a paypal action for index.php...

CVE-2007-2824

CVE-2007-2824 describes a SQL injection in AlstraSoft E-Friends (versions 4.21 and earlier) where the pack parameter in the paypal action of index.php is unsafely handled, allowing remote attackers to execute arbitrary SQL commands. The underlying issue is unsanitized user input fed into a databa...

Design/Logic Flaw

AlstraSoft Live Support 1.21 sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request to admin/managesettings.php...

CVE-2007-2775

AlstraSoft Live Support 1.21 sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request to admin/managesettings.php...

CVE-2007-2776

AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject a credential variable setting and obtain administrative access via a direct request to admin/changeinfo.php...

Design/Logic Flaw

AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject a credential variable setting and obtain administrative access via a direct request to admin/changeinfo.php...

Unrestricted file upload

Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary .php filename in the zip parameter, which is created under sptemplates/...

CVE-2007-2777

Unrestricted file upload vulnerability in admin/addsptemplate.php in AlstraSoft Template Seller Pro 3.25 and earlier allows remote attackers to execute arbitrary PHP code via an arbitrary .php filename in the zip parameter, which is created under sptemplates/...

CVE-2007-2776

AlstraSoft Template Seller Pro 3.25 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to inject a credential variable setting and obtain administrative access via a direct request to admin/changeinfo.php...

CVE-2007-2775

CVE-2007-2775 affects AlstraSoft Live Support 1.21. The issue arises when the application issues a redirect but does not exit after missing administrative credentials, enabling a remote attacker to obtain administrative access via a direct request to admin/managesettings.php. The NVD description ...

CVE-2007-2775

AlstraSoft Live Support 1.21 sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request to admin/managesettings.php...

CVE-2007-2777

CVE-2007-2777: Unrestricted file upload in AlstraSoft Template Seller Pro

CVE-2007-2776

The CVE-2007-2776 entry concerns AlstraSoft Template Seller Pro (version 3.25 and earlier). A flaw in the redirect/exit handling when administrative credentials are missing allows a remote attacker to craft a request that injects a credential variable setting and gains administrative access via a...