IDIC Blogs Shell Upload

'/ -.- --------------------oOO------OOo---------------------- | IDIC Blogs Arbitrary File Upload Vulnerability | --------------------------------------------------------- ! Discovered: cr4wl3r ! Site: http://0xuht.org ! Download: http://sourceforge.net/projects/idicblogs/files/ ! Version: - !...

45000 Wordpress blogs hacked on 2nd day of Spam campaign

Yesterday I have reported about a huge mysterious hack in wordpress servers, that cause compromise of 15000 wordpress account and hacker managed to post same spam article of "Money making sites" with title - "Im getting paid!" on each blog. We explained how hacker was earning in thousands of...

Rock band 'Garbage' twitter account Hacked to spam monetized link

Official Twitter account of Rock band 'Garbage' has been compromised and hacker is posting Spam tweets and links using adf.ly, which is a url shortener service that pays on clicks. Hacked twitter account hack around 55,563 Followers. Hacker can post malicious links also, but in this case we can s...

Sql injection

Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to 1 authorslist.php, 2 blogslist.php, 3 categorylist.php, 4 commentslist.php, 5 policylist.php, 6 ratelist.php, 7...

CVE-2011-5110

Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to 1 authorslist.php, 2 blogslist.php, 3 categorylist.php, 4 commentslist.php, 5 policylist.php, 6 ratelist.php, 7...

CVE-2011-5110

Multiple SQL injection vulnerabilities in Blogs Manager 1.101 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to 1 authorslist.php, 2 blogslist.php, 3 categorylist.php, 4 commentslist.php, 5 policylist.php, 6 ratelist.php, 7...

CVE-2011-5110

CVE-2011-5110 involves multiple SQL injection vulnerabilities in Blogs Manager (version 1.101 and earlier). The underlying issue is improper handling of the SearchField parameter during a search action, allowing remote attackers to inject SQL via endpoints such as _authors_list.php, _blogs_list.p...

Tumblr Users Should Beware of Cookie Thieves

Two researchers say they’ve found a security hole in Tumblr, one of the most popular sites on the Internet, that could steal users’ authentication cookies to break into their accounts. Aditya Gupta and Subho Halder say they’ve tried to contact Tumblr about the vulnerability by using mail and...

Expert Warns That WordPress Autoupdate Feature Used To Infect Blogs With Malware

UPDATE: More than 1,000 WordPress blogs are currently being infected by a form of malware that has ‘piggybacked’ its way onto the blogging platform using the WordPress automatic update function, a security researcher has discovered. According to Denis Sinegubko, founder of Unmask Parasites, the...

Baby Gekko CMS 1.1.5c Cross Site Scripting

Baby Gekko CMS v1.1.5c Multiple Stored Cross-Site Scripting Vulnerabilities Vendor: Baby Gekko, Inc. Product web page: http://www.babygekko.com Affected version: 1.1.5c Summary: BabyGekko strives to deliver high quality websites and other web content fast and easy for all end users. It is a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 logindata parameter to admin/auth.php; 2 nb parameter to admin/blogs.php; 3 type, 4 sortby, 5 order, or 6 status parameters to admin/comments.php; or ...

BeWelcome Cross Site Scripting

Exploit Title: BeWelcome Cross Site Scripting Date: 10.02.2012 Author: Sony Software Link: http://www.bewelcome.org Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2012/02/bw-rox-cross-site-scripting.html...

Blogs manager <= 1.101 SQL Injection Vulnerability

Dear all, I have found a SQL injection vulnerability in Blogs manager = 1.101 It seems to be version 1.101 as you can see in the files section of sourceforge. I reported the vulnerability to the vendor but no response as stated in the advisory. Best, muuratsalo -- ADVISORY --...

Blogs manager 1.101 - SQL Injection

Blogs manager 1.101 - SQL Injection ------------------------------------------------------------------------ Blogs manager = 1.101 SQL Injection Vulnerability ------------------------------------------------------------------------ author............: muuratsalo Revshell.com contact...........:...

Blogs Manager 1.101 SQL Injection

------------------------------------------------------------------------ Blogs manager = 1.101 SQL Injection Vulnerability ------------------------------------------------------------------------ author............: muuratsalo Revshell.com contact...........: muuratsaloatgmaildotcom...

Blogs manager 1.101 - SQL Injection

------------------------------------------------------------------------ Blogs manager = 1.101 SQL Injection Vulnerability ------------------------------------------------------------------------ author............: muuratsalo Revshell.com contact...........: muuratsaloatgmaildotcom...

WordPress Plugin BuddyPress 1.2.10 / WordPress Theme DEV Blogs Mu 1.2.6 (WordPress 3.1.4) - Regular Subscriber HTML Injection

source: https://www.securityfocus.com/bid/49765/info Multiple products are prone to an HTML-injection vulnerability because they fail to sufficiently sanitize user-supplied input. An attacker could exploit this vulnerability to execute arbitrary script code in the browser of an unsuspecting victi...

WordPress Plugin BuddyPress 1.2.10 WordPress Theme DEV Blogs Mu 1.2.6 (WordPress 3.1.4) - Regular Subscriber HTML Injection

WordPress Plugin BuddyPress 1.2.10 WordPress Theme DEV Blogs Mu 1.2.6 WordPress 3.1.4 - Regular Subscriber HTML Injection source: https://www.securityfocus.com/bid/49765/info Multiple products are prone to an HTML-injection vulnerability because they fail to sufficiently sanitize user-supplied...

Skadate Blogs Cross Site Scripting

Exploit Title: Skadate Blogs Cross Site Scripting Date: 7.08.2011 Author: Sony Software Link: http://www.skadate.com/ Google Dorks: member/blogs.php?tag= povered by skadate Blog : http://st2tea.blogspot.com .................................................................. Demo:...

78000 Indian Blogs Hacked by ZHC

78000 Indian Blogs Hacked by ZHC Each and every blog hosted on Blog.co.in has been hacked by ZCOMPANY HACKING CREW. There are around 78000 blogs hosted on this service , Represent Indian blogs Service. Reason of Hacking By hackers : ZCompany Hacking Crew Observes Black Day with the people of Indi...