project alumni v1.0.9 (info.php) SQL Injection Vulnerability

...:::::project alumni v1.0.9 info.php SQL Injection Vulnerability ::::.... Virangar Security Team www.virangar.net -------- Discoverd By :virangar security teamhadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra & all virangar members & all hackerz greetz:to my best friend in the wor...

Alumni 1.0.81.0.9 - info.php?id SQL Injection

Alumni 1.0.81.0.9 - info.php?id SQL Injection source: https://www.securityfocus.com/bid/29019/info Project Alumni is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues...

Alumni 1.0.8/1.0.9 - 'index.php?year' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29019/info Project Alumni is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input. Exploiting these issues could allow an attacker to steal cookie-based...

Project Alumni Index.PHP Act参数本地文件包含漏洞

Project Alumni是一款基于PHP的WEB应用程序。 Project Alumni不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'Index.PHP'脚本对用户提交的'act'参数缺少过滤，提交包含多个"../"字符作为参数数据，可绕过WEB ROOT限制，以WEB权限查看系统文件内容。 Project Alumni 1.0.9 目前没有解决方案提供： https://sourceforge.net/projects/project-alumni/...

CVE-2007-6184

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

Directory traversal

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

CVE-2007-6184

CVE-2007-6184 affects Project Alumni 1.0.9. The vulnerability arises in index.php where an attacker can use a .. in the act parameter to perform a directory traversal, allowing remote inclusion and execution of local files. The condition is an unrestricted act parameter that leads to file inclusi...

CVE-2007-6184

Directory traversal vulnerability in index.php in Project Alumni 1.0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the act parameter...

projectalumni-disclose.txt

project alumni 1.0.9 remote file disclosure vulnerability download : https://sourceforge.net/projects/project-alumni/ vulnerable code on index.php include$SERVER'DOCUMENTROOT' . "/pages/" . $GET'act' . ".page.inc.php"; exploit : http://victim/path/index.php?act=../../../../../../etc/passwd%00...

project alumni 1.0.9 (index.php act) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ======================================================================= project alumni 1.0.9 index.php act Local File Inclusion Vulnerability ======================================================================= project alumni 1.0.9 remo...

project alumni 1.0.9 - index.php?act Local File Inclusion

project alumni 1.0.9 - index.php?act Local File Inclusion project alumni 1.0.9 remote file disclosure vulnerability download : https://sourceforge.net/projects/project-alumni/ vulnerable code on index.php include$SERVER'DOCUMENTROOT' . "/pages/" . $GET'act' . ".page.inc.php"; exploit :...

project alumni 1.0.9 (index.php act) Local File Inclusion Vulnerability

No description provided by source. project alumni 1.0.9 remote file disclosure vulnerability download : https://sourceforge.net/projects/project-alumni/ vulnerable code on index.php include$SERVER'DOCUMENTROOT' . "/pages/" . $GET'act' . ".page.inc.php"; exploit :...

project alumni 1.0.9 - 'index.php?act' Local File Inclusion

project alumni 1.0.9 remote file disclosure vulnerability download : https://sourceforge.net/projects/project-alumni/ vulnerable code on index.php include$SERVER'DOCUMENTROOT' . "/pages/" . $GET'act' . ".page.inc.php"; exploit : http://victim/path/index.php?act=../../../../../../etc/passwd%00...

Project Alumni View/News SQL注入漏洞

Project Alumni View/News是一款基于PHP的WEB应用程序。 Project Alumni View/News不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于脚本对用户提交的'year'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或可能操作数据库。 Project Alumni Project Alumni 1.0.9 Project Alumni Project Alumni 1.0.8 目前没有解决方案提供：...

CVE-2007-6126

Multiple cross-site scripting XSS vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to 1 xml/index.php; or 2 the year parameter to view.page.inc.php, which is reachable through a view action to the top-level...

CVE-2007-6127

Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to 1 view.page.inc.php, which is reachable through a view action to index.php; or 2 the year parameter to news.page.inc.php, which is reachabl...

Sql injection

Multiple SQL injection vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to execute arbitrary SQL commands via the year parameter to 1 view.page.inc.php, which is reachable through a view action to index.php; or 2 the year parameter to news.page.inc.php, which is reachabl...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in project alumni 1.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the year parameter to 1 xml/index.php; or 2 the year parameter to view.page.inc.php, which is reachable through a view action to the top-level...

CVE-2007-6126

CVE-2007-6126 affects Project Alumni versions 1.0.9 and earlier. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary scripts via the year parameter in (1) xml/index.php and (2) view.page.inc.php, reachable through a view action to index.php. The...

CVE-2007-6127

CVE-2007-6127 affects project alumni 1.0.9 and earlier. The vulnerability is a SQL injection in the year parameter of two PHP entry points: view.page.inc.php (accessed via a view action to index.php) and news.page.inc.php (via a news action to index.php). Exploitation allows remote attackers to e...