WordPress BP Group Documents多个漏洞

WordPress是一款内容管理系统。 WordPress BP Group Documents“显示名称”和“描述”字段存在存储型跨站脚本漏洞，跨站请求伪造和文件移动漏洞。 0 BP Group Documents 1.2.1 厂商补丁： WordPress ----- WordPress 1.2.2版本以修复此漏洞，建议用户下载使用： http://wordpress.org/plugins/bp-group-documents/ Stored XSS ================ Go to the upload form, select a document to uploa...

WordPress BP Group Documents Plugin 1.2.1 - Multiple Vulnerabilities

BP Group Documents plugin is prone to multiple vulnerabilities. 1. Stored XSS - “Display name” and “Description” fields are not escaped. It means that any tags can be stored in them. 2. Cross-site request forgery - the fields are vulnerable and an unauthenticated user can logged in user to edit a...

WordPress Plugin BP Group Documents 1.2.1 - Multiple Vulnerabilities

WordPress Plugin BP Group Documents 1.2.1 - Multiple Vulnerabilities Details ================ Software: BP Group Documents Version: 1.2.1 Homepage: http://wordpress.org/plugins/bp-group-documents/ CVSS: 8 High; AV:N/AC:L/Au:S/C:P/I:P/A:C Description ================ Stored XSS vulnerability in BP...

WordPress Plugin BP Group Documents 1.2.1 - Multiple Vulnerabilities

Details ================ Software: BP Group Documents Version: 1.2.1 Homepage: http://wordpress.org/plugins/bp-group-documents/ CVSS: 8 High; AV:N/AC:L/Au:S/C:P/I:P/A:C Description ================ Stored XSS vulnerability in BP Group Documents 1.2.1 Vulnerability ================ “Display name”...

Using Kernel Exploits to Bypass Sandboxes for Fun and Profit

Researchers and attackers alike are quickly discovering you don’t need a fancy Java or Flash exploit to beat application sandboxes. Exploiting an unpatched kernel vulnerability in the underlying operating system, one that’s likely to stay unpatched for a long time, will do just fine. Twice this...

Wordpress bp-gallery plugin v1.2.5 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

BarizWeb v1 - R|File Upload Vulnerability (BP Method)

Exploit for php platform in category web applications ----------------------------------------------------------- I MEMBER FROM IN3CT0R TEAM. 1337 DAY .. My + Author : KnocKout Contact : email protected E-Mail : email protected HomePage : http://h4x0resec.blogspot.com Reference :...

BP Twitter Account Hacked

Oil giant BP suffered further embarrassment after its official Twitter account was hacked. Pranksters purloined the @BPAmerica Twitter account to write “Terry is now in charge of operation Top Kill, work will recommence after we find a XXL wetsuit. bpcares oilspill”. Read the full article. The...

BP Blog Database Disclosure

BP Blog V6.0 & V7.0 & V8.0 & V9.0 Database Disclosure Vulnerability I BP Blog V6.0 & V7.0 & V8.0 & V9.0 I Script Website : http://blog.betaparticle.com/ I Found by : Dxil I Contact : [email protected] D "powered by BP Blog 7.0" or "powered by BP Blog 8.0" E www.site.com/path/Blog.mdb E V6.0 --...

BP Blog 6.0/7.0/8.0/9.0 Remote Database Disclosure Vulnerability

Exploit for unknown platform in category web applications ================================================================ BP Blog 6.0/7.0/8.0/9.0 Remote Database Disclosure Vulnerability ================================================================ BP Blog V6.0 & V7.0 & V8.0 & V9.0 Database...

BP Blog 6.0/7.0/8.0/9.0 Remote Database Disclosure Vulnerability

No description provided by source. BP Blog V6.0 & V7.0 & V8.0 & V9.0 Database Disclosure Vulnerability I BP Blog V6.0 & V7.0 & V8.0 & V9.0 I Script Website : http://blog.betaparticle.com/ I Found by : Dxil I Contact : [email protected] D "powered by BP Blog 7.0" or "powered by BP Blog 8.0" E...

BP Blog 6.07.08.09.0 - Remote Database Disclosure

BP Blog 6.07.08.09.0 - Remote Database Disclosure BP Blog V6.0 & V7.0 & V8.0 & V9.0 Database Disclosure Vulnerability I BP Blog V6.0 & V7.0 & V8.0 & V9.0 I Script Website : http://blog.betaparticle.com/ I Found by : Dxil I Contact : [email protected] D "powered by BP Blog 7.0" or "powered by BP Bl...

BP Blog 6.0/7.0/8.0/9.0 - Remote Database Disclosure

BP Blog V6.0 & V7.0 & V8.0 & V9.0 Database Disclosure Vulnerability I BP Blog V6.0 & V7.0 & V8.0 & V9.0 I Script Website : http://blog.betaparticle.com/ I Found by : Dxil I Contact : [email protected] D "powered by BP Blog 7.0" or "powered by BP Blog 8.0" E www.site.com/path/Blog.mdb E V6.0 --...

Sql injection

Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to templatepermalink.asp and 2 cat parameter to templatearchivescat.asp...

CVE-2008-2554

Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to templatepermalink.asp and 2 cat parameter to templatearchivescat.asp...

CVE-2008-2554

Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to templatepermalink.asp and 2 cat parameter to templatearchivescat.asp...

CVE-2008-2554

The CVE-2008-2554 entry describes SQL injection vulnerabilities in BP Blog 6.0. The affected component is BP Blog 6.0, with vulnerable inputs being the id parameter to template_permalink.asp and the cat parameter to template_archives_cat.asp, leading to arbitrary SQL execution. The underlying cau...

CVE-2008-2554: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in BP Blog 6.0 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to templatepermalink.asp and 2 cat parameter to templatearchivescat.asp...

BP Blog 6.0 (id) Remote Blind SQL Injection Vulnerability

BP Blog 6.0 id Remote Blind SQL Injection Vulnerability JosS, Jose Luis Gуngora Fernбndez Spanish Hackers Team www.spanish-hackers.com + Info: Software: bp blog HomePage: http://blog.betaparticle.com/ Exploit: Blind SQL Injection High Vuln file: templatepermalink.asp Vuln file2:...

BP Blog 6.0 (id) Remote Blind SQL Injection Vulnerability

No description provided by source. --==+=================== Spanish Hackers Team www.spanish-hackers.com =================+==-- --==+ bp blog = 6.0 Multiple Blind SQL Injection Vulnerability +==-- --==+====================================================================================+==-- + Jos...