PT-2015-5239

Name of the Vulnerable Software and Affected Versions Free Reprintables ArticleFR version 3.0.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the getProfile function in system/profile.functions.php via the username parameter to the...

PT-2015-5238

Name of the Vulnerable Software and Affected Versions Free Reprintables ArticleFR version 3.0.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the q parameter to the "search/v/" API endpoint. Recommendations For version 3.0.5, avoid...

CVE-2015-1364: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/...

articleFR CMS 3.0.5 Cross Site Scripting

Vulnerability title: XSS vulnerability in articleFR CMS 3.0.5 Product: articleFR Vendor: http://freereprintables.com Affected version: version 3.0.5 Download link: https://github.com/articlefr/articleFR Fixed version: N/A Google dork: N/A Author: Tran Dinh Tien [email protected] & ITAS Team...

articleFR CMS 3.0.5 SQL Injection Vulnerability

articleFR CMS version 3.0.5 suffers from a remote SQL injection vulnerability. Vulnerability title: SQL injection vulnerability in articleFR CMS 3.0.5 Product: articleFR Vendor: http://freereprintables.com Affected version: version 3.0.5 Download link: https://github.com/articlefr/articleFR Fixed...

articleFR CMS 3.0.5 Arbitrary File Upload

Vulnerability title: Arbitrary File Upload in articleFR CMS 3.0.5 Product: articleFR CMS Vendor: http://freereprintables.com Affected version: version 3.0.5 Download link: https://github.com/articlefr/articleFR Fixed version: N/A Author: Tran Dinh Tien [email protected] & ITAS Team www.itas.vn...

ArticleFR CMS 3.0.5 - Arbitrary File Upload

Exploit Title: Arbitrary File Upload in articleFR CMS 3.0.5 Google Dork: N/A Date: 01/21/2015 Exploit Author: Tran Dinh Tien [email protected] & ITAS Team www.itas.vn Vendor Homepage: http://freereprintables.com Software Link: https://github.com/articlefr/articleFR Version: version 3.0.5 Tested...

ArticleFR CMS 3.0.5 - SQL Injection

Exploit Title: SQL injection vulnerability in articleFR CMS 3.0.5 Google Dork: N/A Date: 01/21/2015 Exploit Author: Tran Dinh Tien [email protected] & ITAS Team www.itas.vn Vendor Homepage: http://freereprintables.com Software Link: https://github.com/articlefr/articleFR Version: version 3.0.5...

ArticleFR CMS 3.0.5 - Arbitrary File Upload

ArticleFR CMS 3.0.5 - Arbitrary File Upload Exploit Title: Arbitrary File Upload in articleFR CMS 3.0.5 Google Dork: N/A Date: 01/21/2015 Exploit Author: Tran Dinh Tien [email protected] & ITAS Team www.itas.vn Vendor Homepage: http://freereprintables.com Software Link:...

articleFR CMS 3.0.5 SQL Injection

Vulnerability title: SQL injection vulnerability in articleFR CMS 3.0.5 Product: articleFR Vendor: http://freereprintables.com Affected version: version 3.0.5 Download link: https://github.com/articlefr/articleFR Fixed version: N/A Google dork: N/A Author: Tran Dinh Tien [email protected] & ITA...

ArticleFR CMS 3.0.5 - SQL Injection

ArticleFR CMS 3.0.5 - SQL Injection Exploit Title: SQL injection vulnerability in articleFR CMS 3.0.5 Google Dork: N/A Date: 01/21/2015 Exploit Author: Tran Dinh Tien [email protected] & ITAS Team www.itas.vn Vendor Homepage: http://freereprintables.com Software Link:...

Improper Access Control in ArticleFR

Advisory ID: HTB23219 Product: ArticleFR Vendor: Free Reprintables Vulnerable Versions: 11.06.2014 and probably prior Tested Version: 11.06.2014 Advisory Publication: June 11, 2014 without technical details Vendor Notification: June 11, 2014 Public Disclosure: July 30, 2014 Vulnerability Type:...

SQL Injection Vulnerability in ArticleFR

Advisory ID: HTB23225 Product: ArticleFR Vendor: Free Reprintables Vulnerable Versions: 3.0.4 and probably prior Tested Version: 3.0.4 Advisory Publication: July 23, 2014 without technical details Vendor Notification: July 23, 2014 Public Disclosure: August 20, 2014 Vulnerability Type: SQL...

ArticleFR CMS 'id' Parameter SQL Injection Vulnerability

ArticleFR CMS is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-5097

Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a 1 get or 2 set action to rate.php...

CVE-2014-5097

CVE-2014-5097 describes SQL injection in ArticleFR CMS (Free Reprintables) versions 3.0.4 and earlier. The vulnerability arises from insufficient sanitization of the HTTP GET parameter “id” passed to /rate.php when act is either “get” or “set,” allowing remote attackers to execute arbitrary SQL c...

CVE-2014-5097

Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a 1 get or 2 set action to rate.php...

PT-2014-6275

Name of the Vulnerable Software and Affected Versions Free Reprintables ArticleFR versions 3.0.4 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in a rate.php endpoint, specifically through a 1 get or 2 set action...

CVE-2014-5097: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Free Reprintables ArticleFR 3.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter in a 1 get or 2 set action to rate.php...

ArticleFR - 'id' SQL Injection

source: https://www.securityfocus.com/bid/69307/info ArticleFR is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, ...