[bWM#015] SQL-Injection @ Woltlab Burning Board + MOD Guthabenhack 1.3

http://badWebMasters.net ben moeckel security research ------------------------------------------------- badWebMasters security advisory 015 SQL-Injection @ Woltlab Burning Board + MOD Guthabenhack 1.3 Discovery Date: 2003-07-28 Original Advisory: http://badwebmasters.net/adv/015/ text/html Legal...

MOD Guthabenhack 1.3 For Woltlab Burning Board - SQL Injection

MOD Guthabenhack 1.3 For Woltlab Burning Board - SQL Injection source: https://www.securityfocus.com/bid/8321/info MOD Guthabenhack For Woltlab Burning Board reported prone to an SQL injection vulnerability. It has been reported that MOD Guthabenhack fails to sufficiently sanitize user input. It...

MOD Guthabenhack 1.3 For Woltlab Burning Board - SQL Injection

source: https://www.securityfocus.com/bid/8321/info MOD Guthabenhack For Woltlab Burning Board reported prone to an SQL injection vulnerability. It has been reported that MOD Guthabenhack fails to sufficiently sanitize user input. It has been reported that this may allow the attacker to bypass...

PBLang 4.0/4.56 Bulletin Board System - IMG Tag HTML Injection

source: https://www.securityfocus.com/bid/8286/info PBLang is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code encapsulated in PBLang tags, when posting to the bulletin board. Attacker supplied code may be rendered in the web...

PBLang 4.04.56 Bulletin Board System - IMG Tag HTML Injection

PBLang 4.04.56 Bulletin Board System - IMG Tag HTML Injection source: https://www.securityfocus.com/bid/8286/info PBLang is prone to an HTML injection vulnerability. An attacker may exploit this issue by including hostile HTML and script code encapsulated in PBLang tags, when posting to the...

Forum51/Board51/News51 Users Disclosure

The remote web server is running a bulletin board application Forum51, Board51, or News51 with an information disclosure vulnerability. It is possible to retrieve usernames and password hashes by requesting '/data/user.idx'. A remote attacker could use this information to mount further attacks...

Invision Power Board v1.1.2

=========================================== Security REPORT Invision Power Board v1.1.2 =========================================== Product: Power Board v1.1.2 maybe earlier Versions Vulnerablities: cross site scripting, sql-injection, install- and admin-issues, os-command execution Vuln.-Classes...

CVE-2003-0395

Ultimate PHP Board UPB 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administrator executes adminiplog.php...

UPB: Discussion Board/Web-Site Takeover

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: UPB: Discussion Board/Web-Site Takeover product: Ultimate PHP Board v1.9 latest vendor: www.myupb.com risk: high date: 05/24/2k3 discovered by: euronymous /F0KP advisory urls: http://f0kp.iplus.ru/bz/024.en.txt...

CVE-2003-0395

Ultimate PHP Board UPB 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administrator executes adminiplog.php...

CVE-2003-0395: Improper Control of Generation of Code

Ultimate PHP Board UPB 1.9 allows remote attackers to execute arbitrary PHP code with UPB administrator privileges via an HTTP request containing the code in the User-Agent header, which is executed when the administrator executes adminiplog.php...

Several bugs found in "Spyke's PHP Board"

================================================ ------------------------------------------------ ------------www.bright-shadows.net------------ ------------------------------------------------ --------------theblacksheep&erik-------------- ------------------------------------------------...

PT-2003-1586 · Upb · Ultimate Php Board

Name of the Vulnerable Software and Affected Versions: Ultimate PHP Board UPB version 1.9 Description: The issue allows remote attackers to execute arbitrary PHP code with administrator privileges. This is achieved via an HTTP request containing the code in the User-Agent header, which is execute...

Spyke Multiple Remote Vulnerabilities

The remote host is using Spyke - a web board written in PHP. This board stores vital information in the file info.dat, which can be downloaded by anyone. This file contains the name of the administrator of the website, as well as its password. Another flaw lets an attacker download information...

Ultimate PHP Board 1.9 - 'admin_iplog.php' Arbitrary PHP Execution

source: https://www.securityfocus.com/bid/7678/info A vulnerability has been reported in Ultimate PHP Board. The problem is said to occur due to insufficient sanitization of user-supplied input before including log data into a PHP file. As a result, it may be possible for a remote attacker to...

Ultimate PHP Board 1.9 - admin_iplog.php Arbitrary PHP Execution

Ultimate PHP Board 1.9 - adminiplog.php Arbitrary PHP Execution source: https://www.securityfocus.com/bid/7678/info A vulnerability has been reported in Ultimate PHP Board. The problem is said to occur due to insufficient sanitization of user-supplied input before including log data into a PHP...

II-Labs Advisory: Remote code execution in YaBBse 1.5.2 (php version)

Illegal Instruction Labs Advisory ------------------------------------------------------------------------ Advisory name: Remote code execution in YaBBse 1.5.2 php version Advisory number: 13 Application: Yet another Bulletin Board 1.5.2 Vendor: www.yabbse.org Date: 06.05.2003 Impact: Attacker ca...

Invision Power Board Plaintext Password Disclosure Vuln

Invision Power Board Plaintext Password Disclosure Vuln ------------------------------------------------------- Version: All? Problem: Invision Power Board gives an admin the option to create a pass protected forum. The problem with this is that the password is then stored in the cookie fully...

Web Wiz Forums all version db stealing

.:: Decription ::. Web Wiz Forums, the free award winning ASP bulletin board system is available in a boxed version with link removal code. .:: Vendor ::. http://www.webwizguide.info .:: Problem ::. By default all passwords are kept on admin/wwforum.mdb Example:...

Two Invision Power Board 1.1.x vulns

Hola, Invision Power Services have continued to show their amazing support and understanding for the security community by release two patches for their 'Invision Power Board' product now one of the most widely used 'Board' programs around. Without sending out any security mailing list...