CLONEBID B2B Marketplace Multiple Vulnerabilities

No description provided by source. / Name : CLONEBID B2B Marketplace Vendor : http://www.clonebid.com Author : Hamza 'MizoZ' N. Email : mizozxatgmaildotcom Greetz : Zuka ! / SQL Injection : File : selloffers.php , Get : cid HOST/PATH/selloffers.php?cid=INJECTION Demo :...

B2B Classic Trading Script (offers.php) SQL Injection Vulnerability

No description provided by source. / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...

Softbiz B2B trading Marketplace Script buyers_subcategories SQL Injection Vulnerability

No description provided by source. Exploit Title: Softbiz B2B trading Marketplace Script buyerssubcategories SQL Injection Vulnerability Date :15/4/2010 Author : AnGrY BoY Contact: [email protected] & [email protected] Home : http://www.kurd-security.com Software Link : N/A Version : Softbiz B2B...

qibocms B2b 某隐蔽SQL注入漏洞

简要描述： 过滤不严。 详细说明： 在qibob2b/hy/member/homepagectrl/picuploadsave.php中 $arrayname=isarray$postfile?$FILESpostfilename:$postfilename; $title=$title?$title:$arrayname; $mynamestr=explode".",strtolower$arrayname; $myname=$mynamestrcount$mynamestr-1; if!inarray$myname,array'gif','jpg'...

Destoon B2B 2014-05-21最新版绕过全局防御暴力注入（官方Demo可重现）

简要描述： destoon某加密函数缺陷可破解导致注入 由于字符串加密，所以自带的全局stripsql gpc等直接无视了 使用不安全的“随机数”的实例 搬个小凳子吧，这个一时半会儿说不完。。。 详细说明： 出问题的是用于cookie加解密的encrypt和decrypt函数 首先看一下函数内容include/global.func.php 122行 function encrypt$txt, $key = '' $key or $key = DTKEY; //DTKEY是在安装时生成的一个15位随机字符串 $rnd = md5microtime;//缺陷 下面说 $len =...

qibocms b2b /news/js.php SQL注入漏洞

No description provided by source...

DESTOON B2B网站管理系统V5.0多处存储型xss(有点鸡肋)

简要描述： ..... 详细说明： 直接在http://demo.destoon.com/v5.0上弄的。 存储型Xss一：商务便签存在存储型xss 查看源码 存储型Xss二：添加商友分类 查看源码 漏洞证明： img src="https://images.seebug.org/upload/201401/092003025209456b7560ace8d9091838f2206a57.jpg" alt="uu0.jpg" width="600" onerro...

CVE-2013-5413

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action, which allows remote attackers to bypass authentication by leveraging an unattended workstation...

CVE-2013-5407

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web site, related to a "frame injection" issue...

CVE-2013-5405

Multiple cross-site scripting XSS vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters...

CVE-2013-5406

Multiple cross-site scripting XSS vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, leading to improper interaction with the Windows MHTML protocol handler...

CVE-2013-5409

Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-5411

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters...

Design/Logic Flaw

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not properly restrict use of FRAME elements, which allows remote authenticated users to bypass intended access restrictions or obtain sensitive information via a crafted web site, related to a "frame injection" issue...

Sql injection

Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Code injection

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote attackers to inject links and trigger unintended navigation or actions via unspecified vectors...

Authentication flaw

IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 do not invalidate a session upon a logout action, which allows remote attackers to bypass authentication by leveraging an unattended workstation...

CVE-2013-5406

IBM Sterling B2B Integrator 5.2 and IBM Sterling File Gateway 2.2 are affected by CVE-2013-5406 (Windows MHTML cross-site scripting). The vulnerability involves XSS via unspecified parameters, enabling a remote attacker to inject script through interactions with the Windows MHTML protocol handler...

CVE-2013-5405

Multiple cross-site scripting XSS vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters...