PHPBack 1.3.0 - SQL Injection

Exploit for php platform in category web applications / + Credits: hyp3rlinx Vendor: ================ www.phpback.org Product: ================ PHPBack v1.3.0 Vulnerability Type: =================== SQL Injection CVE Reference: ============== N/A Vulnerability Details: ===================== PHPBa...

modified eCommerce Shopsoftware 2.0.0.0 rev 9678 - Blind SQL Injection

Exploit for php platform in category web applications...

用友某系统多处注入漏洞打包

简要描述： wooyun搜了一下，没有人提，来一发。 详细说明： 首先，该接口是无需权限访问的。 已http://.../bugs/wooyun-2010-0178322为例： ...:8080/uapws/service/nc.itf.bd.crm.ICurrtypeExportToCrmService?wsdl ...:8080/uapws/service/nc.itf.bd.crm.IInvbasdocExportToCrmService?wsdl ...:8080/uapws/service/nc.itf.bd.crm.IMeasdocExportToCrmService?wsd...

Gratipay: Possible Blind SQL injection | Language choice in presentation

I haven't managed to inject something, but I just want to make sure that this input is filtered. See the attached screenshot...

Facebook uses Artificial Intelligence to Describe Photos to Blind Users

Today the Internet has become dominated by images, and it’s the major feature that got Facebook to a Billion daily users. We can not imagine Facebook without photos, but for Millions of blind and visually impaired people, Facebook without photos has been the reality since its launch. But not now!...

Music Quiz - Blind test - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Music Quiz - Blind test published at the 'play' market has multiple vulnerabilities...

gongwalker API Manager v1.1 - Blind SQL Injection

No description provided by source...

SM Soft Tech CMS 1.0 SQL Injection

========================================================== + Title :- SM SOFT TECH CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- http://www.smsofttech.net/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :...

WordPress Booking Calendar Contact Form 1.0.23 盲注

No description provided by source...

53KF /new/client.php sql注入漏洞

利用过程： 53KF 采用ThinkPHP框架， 注入地址：http://xxx.com/new/client.php?m=Statistic&a=setLost&field=chatrobotlost&type=plus&companyid0=1，companyid0存在时间盲注 payload: /new/client.php?m=Statistic&a=setLost&field=chatrobotlost&type=plus&companyid0=-1%20or%201!=sleep5limit%201%23between...

Libsys图书管理系统 /opac/virtual_shelf_lst.php Oracle时间盲注

No description provided by source...

Informatica: [informatica.com] Blind SQL Injection

Hi guys! JSON POST parameter "docId" is vulnerable to Blind SQL Injection attack PoC Raw query POST /vtibin/RatingsCalculator/RatingsCalculator.asmx/CalculateRatings HTTP/1.1 User-Agent: Opera/9.80 Windows NT 6.1; WOW64 Presto/2.12.388 Version/12.17 Host: kb-test.informatica.com Accept-Language:...

Tiny Tiny RSS Blind SQL Injection

Exploit Title: Tiny Tiny RSS Blind SQL Injection Date: 15-02-2016 Software Link: http://tt-rss.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description $itemid inside processcategoryorder is not properly...

Tiny Tiny RSS - Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: Tiny Tiny RSS Blind SQL Injection Date: 15-02-2016 Software Link: http://tt-rss.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description...

Gongwalker API Manager 1.1 Blind SQL Injection

gongwalker API Manager v1.1 - Blind SQL Injection Exploit Title: gongwalker API Manager v1.1 - Blind SQL Injection Date: 2016-01-25 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/gongwalker/ApiManager Software Link:...

WordPress Booking Calendar Contact Form 1.0.23 Shortcode SQL Injection

Exploit Title: Wordpress booking calendar contact form =v1.0.23 - Unauthenticated blind SQL injection Date: 2016-02-08 Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form Exploit Author: Joaquin Ramirez Martinez i0 SEC-LABORATORY Vendor Homepage: http://wordpress.dwbooster.com...

WordPress User Meta Manager 3.4.6 Blind SQL Injection

Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...

WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection

WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...

WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection

Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/ Software Link:...

WordPress User Meta Manager 3.4.6 Plugin - Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://jasonlau.biz/home/...