Itech Multi Vendor Script 6.49 SQL Injection

Exploit Title: Itech Multi Vendor Script 6.49 a SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/multi-vendor-shopping-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application...

Auction Script 6.49 SQL Injection

Exploit Title: Itech Auction Script v6.49 a SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/auction-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview...

Itech Classifieds Script 7.27 - scat SQL Injection

Itech Classifieds Script 7.27 - scat SQL Injection Exploit Title: Itech Classifieds Script v7.27 – SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/classifieds-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

Itech Real Estate Script 3.12 - SQL Injection

Exploit Title: Itech Real Estate Script v3.12 – SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/real-estate-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits...

Itech Multi Vendor Script 6.49 - pl SQL Injection

Itech Multi Vendor Script 6.49 - pl SQL Injection Exploit Title: Itech Multi Vendor Script 6.49 – SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/multi-vendor-shopping-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom...

CVE-2017-5598

An issue was discovered in eClinicalWorks healow@work 8.0 build 8. This is a blind SQL injection within the EmployeePortalServlet, which can be exploited by un-authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

CVE-2017-5569

An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the template.jsp, which can be exploited without the need of authentication and via an HTTP POST request, and which can be used to dump database data out to a malicious server, using an...

CVE-2017-5570

An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13. This is a blind SQL injection within the messageJson.jsp, which can only be exploited by authenticated users via an HTTP POST request and which can be used to dump database data out to a malicious server, using an out-of-band...

B2B Script 4.27 - SQL Injection

Vulnerability: B2B Script v4.27 - SQL Injection Date: 18.01.2017 Software link: http://itechscripts.com/b2b-script/ Demo: http://b2b.itechscripts.com Price: 199$ Category: webapps Exploit Author: Dawid Morawski Website: http://www.morawskiweb.pl Contact: [email protected] 1. Description...

Acunetix Release Web Site Security Pen Testing Tools Free

HTTP editor, fuzzer and sniffer tools help pen testers identify vulnerabilities London, UK – January 2016 – Hot on the release of Acunetix Version 11, pioneering web application security software Acunetix, now delivering Manual Pen Testing Tools at no cost. Penetration testers can make use of an...

Rockstar Games: [IMP] - Blind XSS in the admin panel for reviewing comments

@anshumanbh discovered that it is possible to exploit a Blind XSS vulnerability under the "MOUTHOFF TO ROCKSTAR" section while providing feedback. The result is a XSS vulnerability being exploited on an internal Rockstar Games domain. The way this worked was that an attacker would submit a...

Edge SkateShop Blind SQL Injection

Exploit Title: Edge SkateShop Blind Sql Injection Date: 12/12/2016 Exploit Author: Andrea Bocchetti Vendor HomePage: http://www.sourcecodester.com/php/10964/basic-shopping-cartphpmysql.html Software Link: http://www.sourcecodester.com/sites/default/files/download/gebbz/edgesketch.zip Version : n/...

LocalTapiola: SQL Injection in lapsuudenturva (viestinta.lahitapiola.fi)

Basic report information Summary: Hi, The ctxvarsemail parameter in http://viestinta.lahitapiola.fi/webApp/lapsuudenturva, can be exploited to perform an SQL Injection Attack. The parameter is ctxvarsemail Description: The value inside the ctx tag , doesn't properly sanitized to user input, it ca...

ZM Gallery 1.0 – Authenticated Blind SQL Injection

The plugin is still affected and has been closed. Type user access: admin user. $GET‘order’ is escaped wrong. Attack with Blind Injection PoC python sqlmap.py -u "http://www.example.com/wp-admin/admin.php?page=zmgallery=name=desc" --dbs --cookie="cookie of admin user" --level=5 --dbms=mysql...

DCFM Blog 0.9.7 Blind SQL Injection

DCFM Blog Version 0.9.7 Blind SQL Injection Vulnerability time based-attack ================================================================================ Discovered by NA , NAattutanota.com ======================================== Description ============ Open-source blog project. Free blog...

phpWebAdmin 1.0 SQL Injection Vulnerability

phpWebAdmin version 1.0 suffers from a remote SQL injection vulnerability. !/usr/bin/perl -w phpWebAdmin Version 1.0 SQL Injection Proof Of Concept Exploit =============================================================== Discovered by NA , NAattutanota.com ========================================...

CVE-2016-9272

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service...

CVE-2016-9272

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service...

CVE-2016-9272

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service...

Spring Data JPA Blind SQL Injection Vulnerability

PoC for blind SQL injection bug found in Solita Webhack 2016. Founders: Niklas Särökaari, Joona Immonen Analysis: Arto Santala, Niklas Särökaari, Joona Immonen, Antti Virtanen, Michael Holopainen PoC: Antti Ahola, Antti Virtanen CVE: https://pivotal.io/security/cve-2016-6652 This has been fixed i...