BtiTracker <= 1.4.7 xbtit <= 2.0.542 SQL Injection Vulnerability

No description provided by source. BtiTracker/xBtiTracker Remote SQL Injection Vulnerability Author: InATeam http://inattack.ru/ Affected versions: BtiTracker = 1.4.7, xBtiTracker = 2.0.542 Software site: http://www.btiteam.org/...

BtiTracker <= 1.4.7, xbtit <= 2.0.542 SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================= BtiTracker = 1.4.7, xbtit = 2.0.542 SQL Injection Vulnerability ================================================================= BtiTracker/xBtiTracker Remote SQL Injection...

BtiTracker 1.4.7 / xbtit 2.0.542 - SQL Injection

BtiTracker/xBtiTracker Remote SQL Injection Vulnerability Author: InATeam http://inattack.ru/ Affected versions: BtiTracker = 1.4.7, xBtiTracker = 2.0.542 Software site: http://www.btiteam.org/ ============================================================================== Exploit:...

CVE-2007-5988

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

CVE-2007-5985

Multiple cross-site scripting XSS vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 account.php, 2 moresmiles.php, or 3 recover.php; or 4 the "to" parameter to usercp.php...

Design/Logic Flaw

details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by 1 reading the details of an arbitrary torrent and 2 modifying a torrent owned by a guest...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 account.php, 2 moresmiles.php, or 3 recover.php; or 4 the "to" parameter to usercp.php...

CVE-2007-5986

SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Design/Logic Flaw

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

CVE-2007-5987

details.php in BtiTracker before 1.4.5, when torrent viewing is disabled for guests, allows remote attackers to bypass protection mechanisms via a direct request, as demonstrated by 1 reading the details of an arbitrary torrent and 2 modifying a torrent owned by a guest...

Sql injection

SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2007-5986

SQL injection vulnerability in include/functions.php in BtiTracker before 1.4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2007-5985

Multiple cross-site scripting XSS vulnerabilities in BtiTracker before 1.4.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 account.php, 2 moresmiles.php, or 3 recover.php; or 4 the "to" parameter to usercp.php...

CVE-2007-5988

CVE-2007-5988 affects BtiTracker 1.4.4. The issue lies in blocks/shoutbox_block.php, where user accounts are not verified, enabling remote attackers to post shoutbox entries as arbitrary users by modifying the nick field. Impact: allows impersonation within the shoutbox; the documentation does no...

CVE-2007-5986

CVE-2007-5986 describes an SQL injection in BtiTracker (affected in versions before 1.4.5). The vulnerability exists in include/functions.php and allows remote attackers to execute arbitrary SQL commands via unspecified vectors. The connected sources confirm the product and vulnerable component b...

CVE-2007-5985

CVE-2007-5985: Multiple XSS vulnerabilities in BtiTracker prior to 1.4.5 allow remote attackers to inject arbitrary script/HTML via unspecified vectors to account.php, moresmiles.php, recover.php, or via the to parameter in usercp.php. The NVD entry confirms the same description, with a base scor...

CVE-2007-5987

The CVE-2007-5987 issue affects BtiTracker prior to 1.4.5. It allows remote attackers to bypass access protections via direct requests to details.php when guest torrent viewing is disabled, enabling reading torrent details and potentially modifying a torrent owned by a guest. Root cause is improp...

CVE-2007-5988

blocks/shoutboxblock.php in BtiTracker 1.4.4 does not verify user accounts, which allows remote attackers to post shoutbox entries as arbitrary users via a modified nick field...

CVE-2007-2854

Multiple SQL injection vulnerabilities in accountchange.php in BtiTracker 1.4.1 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 style or 2 langue parameter...

Sql injection

Multiple SQL injection vulnerabilities in accountchange.php in BtiTracker 1.4.1 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 style or 2 langue parameter...