Hanno's projects: blind sql injection

Summary: There exists a possibility that your Serendipity installation is vulnerable to a blind sql injection. Description: By sending specially crafted SQL commands to /plugin/tag/ and timing how long it takes for the server to respond, it is quite possible that the blog backend is interepreting...

ASUSTOR ADM <= 3.1.2.RHG1 Multiple Vulnerabilities - Active Check

ASUSTOR ADM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:asustor:adm"; if description...

CVE-2018-10997

Etere EtereWeb before 28.1.20 has a pre-authentication blind SQL injection in the POST parameters txUserName and txPassword...

CVE-2018-10997

The CVE-2018-10997 affects Etere EtereWeb prior to 28.1.20. A pre-authentication blind SQL injection exists in the POST parameters txUserName and txPassword, allowing an attacker to disclose database content and potentially other sensitive information without authentication. Public references con...

Security Bulletin: Multiple security vulnerabilities exist in IBM InfoSphere Data Click 10.0 (CVE-2013-3034 CVE-2013-3040 CVE-2013-0599 CVE-2013-4057 CVE-2013-4058 CVE-2013-4059 CVE-2013-4066 CVE-2013-4067)

Summary The IBM InfoSphere DataClick administration and reporting console contains multiple security vulnerabilities. Note: IBM InfoSphere DataClick 10.0 is provided with IBM BigInsights version 2.0 and is not separately available. Vulnerability Details CVE ID: CVE-2013-3034 DESCRIPTION: An...

Security Bulletin: Multiple security vulnerabilities exist in IBM InfoSphere Information Server (CVE-2013-4057, CVE-2013-4058 and CVE-2013-4059)

Summary Security vulnerabilities exist in various versions of IBM InfoSphere Information Server or constituent products. See the individual descriptions for details. Vulnerability Details CVE ID: CVE-2013-4057 DESCRIPTION: Due to insufficient safeguards against cross-site request forgery in...

Pie Register <= 3.0.9 - Authenticated Blind SQL Injection

The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin was affected by an Authenticated Blind SQL Injection security vulnerability...

WordPress Pie Register Blind SQL Injection

============================================= MGC ALERT 2018-004 - Original release date: May 10, 2018 - Last revised: June 11, 2018 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2018-10969 ============================================= I. VULNERABILITY...

WordPress Plugin Pie Register 3.0.9 - Blind SQL Injection

WordPress Plugin Pie Register 3.0.9 - Blind SQL Injection Title: WordPress Plugin Pie Register order = escsql $order ; IV. PROOF OF CONCEPT The following URL have been confirmed to all suffer from Time Based SQL Injection. GET...

WordPress Pie Register Plugin < 3.0.9 - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Title: WordPress Plugin Pie Register order = escsql $order ; IV. PROOF OF CONCEPT The following URL have been confirmed to all suffer from Time Based SQL Injection. GET...

WordPress Plugin Pie Register < 3.0.9 - Blind SQL Injection

Title: WordPress Plugin Pie Register order = escsql $order ; IV. PROOF OF CONCEPT The following URL have been confirmed to all suffer from Time Based SQL Injection. GET /wordpress/wp-admin/admin.php?page=pie-invitation-codes&orderby=name&order=desc original GET...

Pornhub: Blind SQL injection and making any profile comments from any users to disappear using "like" function (2 in 1 issues)

Researcher found a blind SQL injection in the profile comment Like functionality, executing on the second request made for a given comment dislikes. Summary The injection was found manually, used discovery methods are basically the same as described in this awesome article by @gerbenjavado:...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

Sql injection

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

CVE-2018-10466

Zoho ManageEngine ADAudit Plus before 5.0.0 build 5100 allows blind SQL Injection...

Sitemakin SLAC 1.0 - my_item_search SQL Injection

Sitemakin SLAC 1.0 - myitemsearch SQL Injection Exploit Title: SLAC v1.0: Blind SQL Injection / XPath Injection Date: 29-05-2018 Vendor Homepage: https://sitemakin.com/login-script-demo Exploit Author: Divya Jain Version: v1.0 CVE: CVE-2018-11535 Category: Webapps Severity: High Tested on: KaLi...

Sitemakin SLAC 1.0 SQL Injection

Exploit Title: SLAC v1.0: Blind SQL Injection / XPath Injection Date: 29-05-2018 Vendor Homepage: https://sitemakin.com/login-script-demo Exploit Author: Divya Jain Version: v1.0 CVE: CVE-2018-11535 Category: Webapps Severity: High Tested on: KaLi LinuXx64 Proof of Concept:...

CVE-2018-11309

Blind SQL injection in couponcode in the MemberMouse plugin 2.2.8 and prior for WordPress allows an unauthenticated attacker to dump the WordPress MySQL database via an applyCoupon action in an admin-ajax.php request...

CVE-2018-11309

CVE-2018-11309 affects the WordPress MemberMouse plugin up to version 2.2.8 (and earlier). The vulnerability is a blind SQL injection in the coupon_code parameter triggered via the applyCoupon action in admin-ajax.php, allowing an unauthenticated attacker to dump the WordPress MySQL database. Con...