Easy POS System - 'login.php' SQL Injection

Exploit: Easy POS System - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/easypossystem/ 1 Sql Injection POST Time Based Blind Note: Time based Injection on POST requests using burp, as output indicated. You...

Cells Blog 3.3 - Reflected Cross-Site Scripting / Blind SQLite Injection

Exploit: Cells v3.3 XSS Reflected & Blind SQLite Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + version: Cells Blog 3.3 + Vendor Homepage: http://cells.tw + 14/01/2014 vendor contacted + 17/01/2014 no response from vendor + 20/01/2014 no response from vendor +...

PizzaInn_Project SQL Injection Vulnerability

Exploit for php platform in category web applications + Exploit: PizzaInnProject - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/restaurantmis/ 1 Sql Injection Time Based Blind PoC:...

Cells Blog 3.3 - XSS Reflected & Blind SQLite Injection Vulnerabilities

Exploit for php platform in category web applications + Exploit: Cells v3.3 XSS Reflected & Blind SQLite Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + version: Cells Blog 3.3 + Vendor Homepage: http://cells.tw + 14/01/2014 vendor contacted + 17/01/2014 no response...

PHPJabbers Event Booking Calendar 2.0多个漏洞

No description provided by source. Event Booking Calendar V2.0 - Multiple Vulnerabilities ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

PHPJabbers Event Booking Calendar 2.0 - Multiple Vulnerabilities

Event Booking Calendar V2.0 - Multiple Vulnerabilities ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : www.phpjabbers.com/event-booking-calendar/ .:. Dork :...

PHPJabbers Event Booking Calendar 2.0 - Multiple Vulnerabilities

PHPJabbers Event Booking Calendar 2.0 - Multiple Vulnerabilities Event Booking Calendar V2.0 - Multiple Vulnerabilities ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script :...

Event Booking Calendar 2.0 Multiple Vulnerabilities

Event Booking Calendar version 2.0 suffers from cross site request forgery, remote SQL injection, and cross site scripting vulnerabilities. Event Booking Calendar V2.0 - Multiple Vulnerabilties ==================================================================== .:. Author : HackXBack .:. Contact...

PHPJabbers Event Booking Calendar 2.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications Event Booking Calendar V2.0 - Multiple Vulnerabilities ==================================================================== .:. Author : HackXBack .:. Contact : email protected .:. Home : http://www.iphobos.com/blog/ .:. Script :...

Event Booking Calendar 2.0 CSRF / XSS / SQL Injection

Event Booking Calendar V2.0 - Multiple Vulnerabilties ==================================================================== .:. Author : HackXBack .:. Contact : [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : www.phpjabbers.com/event-booking-calendar/ .:. Tested On Demo :...

SEC Consult SA-20131227-0 :: IBM Web Content Manager (WCM) XPath Injection

SEC Consult Vulnerability Lab Security Advisory 20131227-0 ======================================================================= title: XPath Injection product: IBM Web Content Manager WCM vulnerable version: 6.x, 7.x, 8.x fixed version: - impact: high homepage: http://www.ibm.com/ found:...

绕过startbbs防御继续盲打管理员(两种方法)

简要描述： startbbs已经对xss有过滤措施，但是有办法绕过。这里我依然以官方为demo作为测试，因为官方的是最新版。 详细说明： 问题出现在发帖的正文文本框：盲打的概率非常高的。 测试了常规的html代码，发现只剩下img标签，其他的都被过滤了，因此可以在img上能发挥作用的只有on系列的事件了。 测试尝试和之前那样 发布上面的代码，发现过滤成下面这样： 尝试用javascript:伪协议去触发：但是又被过滤成这样： 也就是常规的在敏感字符那加入x 来让事件等功能失效。 到了这一步，暂时没有了头绪。 过了几天之后忽然想到之前新浪邮箱的过滤方式也是如此。...

CMS Afroditi 1.0 Blind SQL Injection

Exploit Title: CMS Afroditi v.1.0 Blind SQL Injection Date: 30/12/2013 Exploit Author: projectzero labs Vendor Homepage: http://www.naxtech.com Vendor Informed: 20 & 24/12/2013 Software Demo: http://afroditi.naxtech.com Version: v.1.0 About the software: =================== Αs indicated in the...

Z-Blog php Edition front regular SQL blind injection vulnerability-vulnerability warning-the black bar safety net

Brief description: The second...also a bit puzzled want to ask your developer Detailed description: The problem /zbsystem/function/csystemcommon.php function GetVars$name,$type='REQUEST' if $type=='ENV' $array=&$ENV; if $type=='GET' $array=&$GET; if $type=='POST' $array=&$POST; if $type=='COOKIE'...

InstantCMS 1.10.3 - Blind SQL Injection

Exploit for windows platform in category web applications Advisory Details: High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application. 1 SQL...

iScripts Multicart SQL Injection

Iscripts multicart Multiple vulnerabilities Author : i-Hmx [email protected] sec4ever.com - Vendor have been contacted since 2 years for more than 20 times and he don't give ashit @ all :/ I.Sql Injection Vulns /getProductOptionDetailsAjax.php For Table name Post productoptionid=i-Hmx'/!1337union...

iScripts Support Desk 4.1 SQL Injection

Normal Sql postticketbeforeregistersave.php Staff table post : txtname=faris&[email protected]&prty=0&deptid=11 /!1337andselect 1 fromselect count,concatselect select select distinct concat0x7e,0x27,unhexHexcasttablename as char,0x27,0x7e from informationschema.tables where tableschema=databas...

InstantCMS SQL注入漏洞

CVECAN ID: CVE-2013-6839 InstantCMS是一款内容管理系统。 InstantCMS存在SQL注入漏洞，由于传递的"/catalog/id"的"orderby" HTTP POST参数未充分过滤，允许远程攻击者利用漏洞提交特制的SQL查询，可操作或获取数据库数据。 0 InstantCMS=1.10.3 厂商补丁： InstantCMS ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

iScripts AutoHoster PHP Code Injection Vulnerability

iScripts AutoHoster suffers from file disclosure, PHP code injection, file disclosure, and remote SQL injection vulnerabilities. ?php / + iScripts AutoHoster + Multiple vulnerabilities , PHP Code injection Exploit + Author : i-Hmx + email protected + sec4ever.com , 1337s.cc I.Sql Injection Vuln...

iScripts AutoHoster - additionalsettings.php SQL Injection

iScripts AutoHoster - additionalsettings.php SQL Injection source: https://www.securityfocus.com/bid/64377/info iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these vulnerabilities to compromi...