Cross site scripting

Cross-site scripting XSS vulnerability in post3/Book.asp in Campus Bulletin Board 3.4 allows remote attackers to inject arbitrary web script or HTML via the review parameter...

Sql injection

Multiple SQL injection vulnerabilities in Campus Bulletin Board 3.4 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to post3/view.asp and the 2 review parameter to post3/book.asp...

CVE-2008-2492

Multiple SQL injection vulnerabilities in Campus Bulletin Board 3.4 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to post3/view.asp and the 2 review parameter to post3/book.asp...

CVE-2008-2493

Cross-site scripting XSS vulnerability in post3/Book.asp in Campus Bulletin Board 3.4 allows remote attackers to inject arbitrary web script or HTML via the review parameter...

CVE-2008-2492

Multiple SQL injection vulnerabilities in Campus Bulletin Board 3.4 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to post3/view.asp and the 2 review parameter to post3/book.asp...

CVE-2008-2492

CVE-2008-2492 describes multiple SQL injection flaws in Campus Bulletin Board 3.4 that allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to post3/view.asp and (2) review parameter to post3/book.asp. The connected documents confirm the vulnerable components and impa...

campusbb-multi.txt

/ | || | | | | | | | | /| | | | | || ||| ||||| || C. H. R. O. O. T. SECURITY GROUP - -- ----- --- -- -- ---- --- -- - http://www.chroot.org Hacks In Taiwan | || | | | | | | | Conference 2008 | | | | | | | | | || ||| || |||| http://www.hitcon.org Title :: Campus Bulletin Board v3.4 Multiple...

Campus Bulletin Board v3.4 Multiple Remote Vulnerabilities

/ | || | | | | | | | | /| | | | | || ||| ||||| || C. H. R. O. O. T. SECURITY GROUP - -- ----- --- -- -- ---- --- -- - http://www.chroot.org Hacks In Taiwan | || | | | | | | | Conference 2008 | | | | | | | | | || ||| || |||| http://www.hitcon.org Title :: Campus Bulletin Board v3.4 Multiple Remote...

Campus Bulletin Board 3.4 - post3book.asp?review Cross-Site Scripting

Campus Bulletin Board 3.4 - post3book.asp?review Cross-Site Scripting source: https://www.securityfocus.com/bid/29375/info Campus Bulletin Board is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and a cross-site scripting issue, because it fails to...

Campus Bulletin Board 3.4 - post3view.asp?id SQL Injection

Campus Bulletin Board 3.4 - post3view.asp?id SQL Injection source: https://www.securityfocus.com/bid/29375/info Campus Bulletin Board is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently...

Campus Bulletin Board 3.4 - post3book.asp?review SQL Injection

Campus Bulletin Board 3.4 - post3book.asp?review SQL Injection source: https://www.securityfocus.com/bid/29375/info Campus Bulletin Board is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and a cross-site scripting issue, because it fails to sufficient...

The Campus Request Repairs System 1.2 - sentout.asp Unauthorized Access

The Campus Request Repairs System 1.2 - sentout.asp Unauthorized Access source: https://www.securityfocus.com/bid/29376/info The Campus Request Repairs System is prone to an unauthorized-access vulnerability because it fails to adequately limit access to administrative scripts used for creating...

The Campus Request Repairs System 1.2 - 'sentout.asp' Unauthorized Access

source: https://www.securityfocus.com/bid/29376/info The Campus Request Repairs System is prone to an unauthorized-access vulnerability because it fails to adequately limit access to administrative scripts used for creating accounts. An attacker can exploit this vulnerability to gain unauthorized...

Campus Bulletin Board 3.4 - '/post3/book.asp?review' Cross-Site Scripting

source: https://www.securityfocus.com/bid/29375/info Campus Bulletin Board is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could...

Campus Bulletin Board 3.4 - '/post3/book.asp?review' SQL Injection

source: https://www.securityfocus.com/bid/29375/info Campus Bulletin Board is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could...

Campus Bulletin Board 3.4 - '/post3/view.asp?id' SQL Injection

source: https://www.securityfocus.com/bid/29375/info Campus Bulletin Board is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could...

WebCT 4.x Javascript Session Stealer

WebCT 4.x Javascript Session Stealer Exploits Software: WebCT Campus Edition 4.x http://secunia.com/product/3280/ Affected Version: 4.1.5.8 Discoverer: Benjamin "balupton" Lupton Date Discovered: November 2005 Date Reported: 25/06/2007 Software Author Contacted again on: 20/07/2007 Date Published...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a 1 mail message or 2 discussion board message. NOTE: this might overlap CVE-2005-1076...

CVE-2008-1225

Multiple cross-site scripting XSS vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a 1 mail message or 2 discussion board message. NOTE: this might overlap CVE-2005-1076...

CVE-2008-1225

WebCT Campus Edition 4.1.5.8 contains multiple XSS vulnerabilities when “Don’t wrap text” is enabled, allowing remote authenticated users to inject arbitrary script/HTML via a mail message or discussion board message. Root cause is input handling in the discussion/mail features; exploit details a...