597 matches found
ATutor 1.5.3 - Multiple Remote File Inclusions
ATutor 1.5.3 - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/20634/info ATutor is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows an attacker to execute arbitra...
ATutor 1.5.3 - Multiple Remote File Inclusions
source: https://www.securityfocus.com/bid/20634/info ATutor is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected...
atutor1531.txt
!/usr/bin/php -q -d shortopentag=on = 4.1 allowing SELECT subqueries for ORDER BY statements see http://dev.mysql.com/doc/refman/5.0/en/subqueries.html - with at least 2 links in atlinks table / if $argc5 echo "Usage: php ".$argv0." host path user pass OPTIONS\r\n"; echo "host: target server...
CVE-2006-3996
SQL injection vulnerability in links/index.php in ATutor 1.5.3.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the 1 desc or 2 asc parameters...
CVE-2006-3996
CVE-2006-3996 affects ATutor 1.5.3.1 and earlier in the file links/index.php. The vulnerability is an SQL injection in the desc and asc parameters, allowing remote authenticated users to execute arbitrary SQL commands. The NVD records a CVSS v2 base score of 6.5 (MEDIUM) with network attack vecto...
CVE-2006-3996
SQL injection vulnerability in links/index.php in ATutor 1.5.3.1 and earlier allows remote authenticated users to execute arbitrary SQL commands via the 1 desc or 2 asc parameters...
ATutor <= 1.5.3.1 (links) Remote Blind SQL Injection Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "ATutor = 1.5.3.1 'links' blind SQL injection / admin credentials disclosure\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork, version specific: "Web site engine's code...
ATutor <= 1.5.3.1 (links) Remote Blind SQL Injection Exploit
Exploit for unknown platform in category web applications ============================================================ ATutor = 4.1 allowing SELECT subqueries for ORDER BY statements see http://dev.mysql.com/doc/refman/5.0/en/subqueries.html - with at least 2 links in atlinks table / if $argc5 ec...
ATutor 1.5.3.1 - links Blind SQL Injection
ATutor 1.5.3.1 - links Blind SQL Injection !/usr/bin/php -q -d shortopentag=on = 4.1 allowing SELECT subqueries for ORDER BY statements see http://dev.mysql.com/doc/refman/5.0/en/subqueries.html - with at least 2 links in atlinks table / if $argc5 echo "Usage: php ".$argv0." host path user pass...
ATutor 1.5.3.1 - 'links' Blind SQL Injection
!/usr/bin/php -q -d shortopentag=on = 4.1 allowing SELECT subqueries for ORDER BY statements see http://dev.mysql.com/doc/refman/5.0/en/subqueries.html - with at least 2 links in atlinks table / if $argc5 echo "Usage: php ".$argv0." host path user pass OPTIONS\r\n"; echo "host: target server...
CVE-2006-3821
Multiple cross-site scripting XSS vulnerabilities in ATutor 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 lang parameter in a indexlist.php and 2 year, 3 month, and 4 day parameter in b registration.php...
CVE-2006-3821
Multiple cross-site scripting XSS vulnerabilities in ATutor 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 lang parameter in a indexlist.php and 2 year, 3 month, and 4 day parameter in b registration.php...
CVE-2006-3821
ATutor 1.5.3 is affected by multiple XSS flaws (CVE-2006-3821). The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index_list.php and (2) year, (3) month, and (4) day parameters in registration.php. The NVD entry reports a CVSS v2 base ...
CVE-2006-3662
SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code...
CVE-2006-3662
ATutor 1.5.3 contains a SQL injection in index.php via the fid parameter that could allow remote execution of arbitrary SQL commands. The vendor disputes the vulnerability, but source code analysis suggests it may be legitimate; the parameter is cleansed in version 1.5.3.1. Affected version: ATut...
CVE-2006-3662
SQL injection vulnerability in index.php in ATutor 1.5.3 allows remote attackers to execute arbitrary SQL commands via the fid parameter. NOTE: this issue has been disputed by the vendor, who states "The mentioned SQL injection vulnerability is not possible." However, the relevant source code...
CVE-2006-3484
Multiple cross-site scripting XSS vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 showcourses or 2 currentcat parameters to a admin/createcourse.php, showcourses parameter to b users/createcourse.php, 3 p parameter to c...
CVE-2006-3484
Multiple cross-site scripting XSS vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 showcourses or 2 currentcat parameters to a admin/createcourse.php, showcourses parameter to b users/createcourse.php, 3 p parameter to c...
CVE-2006-3484
ATutor before 1.5.3 is affected by multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote attackers to inject arbitrary web script or HTML via specific parameters: show_courses or current_cat to admin/create_course.php; show_courses to users/create_course.php; p to documenta...
atutor153-xss-sql.txt
ATutor 1.5.3 http://www.atutor.ca -------------------------- Cross Site Scripting XSS -------------------------- http://target.xx/documentation/indexlist.php?lang="alert/EllipsisSecurityTest/ --- POST http://target.xx:80/registration.php?register=Register HTTP/1.0 Accept: / Content-Type:...