Apprain 3.0.2 Cross Site Request Forgery

Exploit Title: Apprain CMF / CSRF ADD/DELETE administrator's account Date: 2013 29 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://www.apprain.com/ Tested on: Linux & Windows, PHP 5.2.9 Affected...

appRain CMF - Multiple Cross-Site Request Forgery Vulnerabilities

source: https://www.securityfocus.com/bid/62061/info appRain CMF is prone to multiple cross-site request-forgery vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible...

appRain CMF - Multiple Cross-Site Request Forgery Vulnerabilities

appRain CMF - Multiple Cross-Site Request Forgery Vulnerabilities source: https://www.securityfocus.com/bid/62061/info appRain CMF is prone to multiple cross-site request-forgery vulnerabilities. Exploiting these issues may allow a remote attacker to perform certain unauthorized actions in the...

CVE-2011-5228

Cross-site scripting XSS vulnerability in the Search module quickstart/search in appRain CMF 0.1.5 allows remote attackers to inject arbitrary web script or HTML via the ss parameter...

CVE-2011-5229

SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATHINFO...

Sql injection

SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATHINFO...

Cross site scripting

Cross-site scripting XSS vulnerability in the Search module quickstart/search in appRain CMF 0.1.5 allows remote attackers to inject arbitrary web script or HTML via the ss parameter...

CVE-2011-5229

SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATHINFO...

CVE-2011-5229

Summary of CVE-2011-5229 (appRain CMF): SQL injection in the Forum module’s quickstart/profile/index.php (PATH_INFO) of appRain CMF 0.1.5 can allow remote SQL commands execution. Affected product/version: appRain CMF

CVE-2011-5228

AppRain CMF is vulnerable to Cross-Site Scripting (XSS) in the Search module (quickstart/search) for version 0.1.5 and earlier (

CVE-2011-5228: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Search module quickstart/search in appRain CMF 0.1.5 allows remote attackers to inject arbitrary web script or HTML via the ss parameter...

CVE-2011-5229: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in quickstart/profile/index.php in the Forum module in appRain CMF 0.1.5 allows remote attackers to execute arbitrary SQL commands via the PATHINFO...

PT-2012-2206

Name of the Vulnerable Software and Affected Versions appRain CMF version 0.1.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the PATH INFO in the quickstart/profile/index.php file within the Forum module. Recommendations For appRain CMF...

PT-2012-2205

Name of the Vulnerable Software and Affected Versions appRain CMF version 0.1.5 Description The issue is related to a cross-site scripting XSS vulnerability in the Search module. This allows remote attackers to inject arbitrary web script or HTML via the ss parameter in the quickstart/search...

CVE-2012-1153

Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory...

CVE-2012-1153: Undefined Security Weakness

Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory...

PT-2012-3102

Name of the Vulnerable Software and Affected Versions appRain CMF versions 0.1.5 and earlier Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the uploadify.php file in the addons/uploadify directory, and then accessing it...

appRain CMF - Arbitrary '.PHP' File Upload (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "appRain CMF...

appRain CMF Arbitrary PHP File Upload Vulnerability

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "appRain CMF...

appRain CMF Arbitrary PHP File Upload Vulnerability

Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/...