138 matches found
Server side request forgery (ssrf)
BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request...
Cross site scripting
Cross-site scripting XSS vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter...
CVE-2008-7056
BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request...
CVE-2008-7056
BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request...
CVE-2008-7057
Affected software: BandSite CMS 1.1.4. Vulnerability: Cross-site scripting (XSS) in merchandise.php, exploitable via the type parameter. Root cause / note: Malicious HTML/script can be injected into the page by manipulating the type parameter. Documents do not specify a concrete exploit string or...
CVE-2008-7058
Cross-site request forgery CSRF vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force a logout via adminpanel/logout.php...
CVE-2008-7057
Cross-site scripting XSS vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter...
CVE-2008-7058
CVE-2008-7058 describes a CSRF vulnerability in BandSite CMS 1.1.4 that allows remote attackers to hijack administrator sessions and force a logout via adminpanel/logout.php . The issue is triggered by cross-site requests performed with an authenticated admin, enabling session manipulation withou...
CVE-2008-7056
BandSite CMS 1.1.4 is affected by CVE-2008-7056 due to missing access control on adminpanel/phpmydump.php, enabling remote attackers to directly request the file and obtain copies of the database. This is documented across NVD/NVD-CVE records and related CVE aggregations. The available descriptio...
BandSite CMS 1.1.4 (members.php memid) SQL Injection Vulnerability
No description provided by source. + BandSite CMS 1.1.4 SQL/Upload Shell Multiple Remote Vulnerabilites + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + Remote SQL Injection - The script is full of SQLI bugs.This is one of them. - Vulnerable code in...
BandSite CMS 1.1.4 - members.php SQL Injection
BandSite CMS 1.1.4 - members.php SQL Injection + BandSite CMS 1.1.4 SQL/Upload Shell Multiple Remote Vulnerabilites + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + Remote SQL Injection - The script is full of SQLI bugs.This is one of them. - Vulnerable code in...
BandSite CMS 1.1.4 SQL Injection
BandSite CMS 1.1.4 SQL/Upload Shell Multiple Remote Vulnerabilites + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + Remote SQL Injection - The script is full of SQLI bugs.This is one of them. - Vulnerable code in includes\content\membercontent.php...
BandSite CMS 1.1.4 - 'members.php' SQL Injection
BandSite CMS 1.1.4 SQL/Upload Shell Multiple Remote Vulnerabilites + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + Remote SQL Injection - The script is full of SQLI bugs.This is one of them. - Vulnerable code in includes\content\membercontent.php...
Authentication flaw
BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the loginauth cookie to true...
CVE-2008-5497
BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the loginauth cookie to true...
CVE-2008-5497
The CVE-2008-5497 entry concerns BandSite CMS version 1.1.4. The connected documents provide concrete detail: remote attackers can bypass authentication and gain administrative access by setting the login_auth cookie to true, yielding full admin control. This describes a cookie-based auth bypass ...
CVE-2008-5497
BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the loginauth cookie to true...
Cross site scripting
Cross-site scripting XSS vulnerability in info.php in Bandwebsite aka Bandsite portal system 1.5 allows remote attackers to inject arbitrary web script or HTML via the section parameter...
CVE-2008-5337
CVE-2008-5337 is a SQL injection in Bandwebsite (Bandsite portal system) 1.5, via lyrics.php id parameter. The vulnerability arises from improper handling of the id input, allowing remote execution of arbitrary SQL commands. Impact is described as partial confidentiality/integrity/availability wi...