PHPFox v3.6.0 (build3) Multiple SQL Injection vulnerabilities

------------------------------------------------------------ PHPFox v3.6.0 build3 Multiple SQL Injection vulnerabilities ------------------------------------------------------------ == Description == - Software link: http://www.phpfox.com - Affected versions: version 3.6.0 build3 is vulnerable...

glFusion 1.3.0 SQL Injection

Information -------------------- Name : SQL Injection Vulnerability in glFusion Software : glFusion 1.3.0 and possibly below. Vendor Homepage : http://www.glfusion.org Vulnerability Type : Blind SQL Injection Severity : Critical Researcher : Omar Kurt Advisory Reference : NS-13-009 Description...

Obehotel CMS Denial Of Service / SQL Injection

OBEHOTEL Spanish CMS Blind SQLinjection / Apache httpd Remote Denial of Service / Directory Listing / Insecure transition from HTTPS to HTTP in form post I-VULNERABILITY ------------------------- Title: OBEHOTEL CMS Blind SQLinjection / Apache httpd Remote Denial of Service / Directory Listing /...

phpdisk blind and front Desk of any user login vulnerability reference using the exp-bug warning-the black bar safety net

File plugins\phpdiskclient\passport.php $str = $SERVER'QUERYSTRING'; if$str parsestrbase64decode$str;// trigger function else exit'Error Param'; /$username = trimgpc'username','G',"; $password = trimgpc'password','G',"; $sign = trimgpc'sign','G',";/ if$sign!= strtouppermd5$action.$ username.$...

Ajax PHP Penny Auction 1.x 2.x - Multiple Vulnerabilities

Ajax PHP Penny Auction 1.x 2.x multiple Vulnerabilities Found by : Taha Hunter Info : Ajax PHP Penny Auction is one of the most proven and reliable Penny Auction software options available on the market. Based on a proprietary AJAX Streaming Engine which has four years of refinement and debugging...

PHPFox 3.6.0 (build3) Multiple SQL Injection Vulnerabilities

PHPFox version 3.6.0 build 3 suffers from multiple remote SQL injection vulnerabilities. ------------------------------------------------------------ PHPFox v3.6.0 build3 Multiple SQL Injection vulnerabilities ------------------------------------------------------------ == Description == - Softwa...

PHPFox 3.6.0 SQL Injection

------------------------------------------------------------ PHPFox v3.6.0 build3 Multiple SQL Injection vulnerabilities ------------------------------------------------------------ == Description == - Software link: http://www.phpfox.com - Affected versions: version 3.6.0 build3 is vulnerable...

SQL Injection in vtiger CRM

High-Tech Bridge Security Research Lab discovered SQL injection vulnerability in vtiger CRM, which can be exploited to execute arbitrary SQL commands in application's database. 1 SQL Injection in vtiger CRM: CVE-2013-5091 The vulnerability exists due to insufficient validation of "onlyforuser" HT...

D-Link Devices UPnP SOAP Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'D-Link Devices UPnP SOAP Command...

McAfee ePO Extension for McAfee Agent Multiple Blind SQL Injection (SB10043)

According to its self-reported version number, the version of ePO Extension for McAfee Agent installed on the remote host has multiple blind SQL injection vulnerabilities. A remote, authenticated user could exploit this to execute arbitrary SQL queries, resulting in arbitrary code execution with...

phpEventCalendar 0.2.3 - Multiple Vulnerabilities

phpEventCalendar v.0.2.3 Multiple Vulnerabilities ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://www.phpcodeworks.com/pec/download...

phpEventCalendar 0.2.3 - Multiple Vulnerabilities

phpEventCalendar 0.2.3 - Multiple Vulnerabilities phpEventCalendar v.0.2.3 Multiple Vulnerabilities ==================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:...

Monkey CMS - Multiple Vulnerabilities

Exploit Title: Monkey CMS - Multiple Vulnerabilities Date: 2013 17 June Exploit Author: Yashar shahinzadeh & Mormoroth Vendor Homepage: http://www.monkeycms.com/ Tested on: Linux & Windows, PHP 5.3.10 Affected Version : All versions Contacts: http://Twitter.com/YShahinzadeh ,...

Joomla Component com_abcalendar Blind Injection Vulnerability

Exploit for php platform in category web applications Joomla Component comabcalendar Blind Injection Vulnerability ============================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : email protected , email protected .:. Home : http://www.iphobos.com/blog/ ....

blind_sqli

This plugin finds blind SQL injections using two techniques: time delays and true/false response comparison. Only one configurable parameters exists: eqlimit Plugin type Audit Options Name | Type | Default Value | Description | Help ---|---|---|---|--- eqlimit | float | 0.9 | String equal ratio 0...

TESO Web 2.0 SQL Injection

============================================ TESO web 2.0 SQLInjection/ Blind SQLInjection ============================================= I. VULNERABILITY ------------------------- Title: TESO SQLInjection/ Blind SQLInjection Vendor:http://www.tesoweb.com Author:Juan Carlos García @secnight Follow...

Habbomobile / Sulake Blind SQL Injection

============================================ Habbomobile-SULAKE- Social Network Blind SQLInjection ============================================= I. VULNERABILITY ------------------------- Habbomobile.com/sulake.com Blind SQLInjection Author:Juan Carlos García Affected items /careers/ /press/award...

AVE.CMS 2.09 - index.php?module Blind SQL Injection

AVE.CMS 2.09 - index.php?module Blind SQL Injection !/usr/bin/env python import urllib, sys, time Exploit Title: AVE.CMS " if url:7 != "http://": url = "http://" + url + "/index.php?module=" else: url = url + "/index.php?module=" database = options = 'Version':'VERSION', 'User':'CURRENTUSER',...

MyMarket 1.72 bypass admin login & product_details blind sqli

Exploit for php platform in category web applications Exploit Title: MyMarket 1.72 bypass admin login & productdetails blind sqli Google Dork: intext:"MyMarket version 1.71" Tested on: Linux Bug finder & Exploit Coder:NEt Bomber http://fb.me/net.bomba Beside other sqli exploits found on exploits...

AVE.CMS 2.09 Blind SQL Injection Vulnerability

AVE.CMS versions less than 2.09 suffer from a remote blind SQL injection vulnerability in the "module" parameter. This is a proof of concept exploit. This issue is addressed in later versions. !/usr/bin/env python import urllib, sys, time Exploit Title: AVE.CMS " if url:7 != "http://": url =...