CVE-2007-3782

MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a table in another database via a view that refers to this external table...

CVE-2007-3782

CVE-2007-3782 affects MySQL Community Server up to version 5.0.44; remote authenticated users can gain update privileges for a table in another database through a view that refers to an external table. Root cause: a view cross-database reference allows privilege escalation. A fix is available in ...

CVE-2007-3780

MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service daemon crash via a malformed password packet in the connection protocol...

CVE-2007-3781

MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such as the table structure...

youtube-bypass2.txt

Youtube.com requires account creation and login before allowing visitors to view videos flagged by users as inappropriate. Sample flagged video: http://www.youtube.com/watch?v=pJg0MYnndnw "This video or group may contain content that is inappropriate for some users, as flagged by YouTube's user...

fujitsu-primergy-disclose.txt

Advisory: Fujitsu-Siemens PRIMERGY BX300 Switch Blade Information Disclosure RedTeam Pentesting discovered an information disclosure in the Fujitsu- Siemens BX300 Switch Blade during a penetration test. By accessing URLs of the web interface directly and aborting the authentication dialog, one is...

Fuzzylime Forum 1.0 (low.php topic) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================ Fuzzylime Forum 1.0 low.php topic Remote SQL Injection Exploit ================================================================ !/usr/bin/perl -w Fuzzylime Forum 1.0 SQL...

Comicsense 0.2 - index.php?epi SQL Injection (2)

Comicsense 0.2 - index.php?epi SQL Injection 2 !/usr/bin/perl -w ComicSense 0.2 SQL Injection Exploit Discovered by: s0cratex Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Original Advisory: http://seclists.org/bugtraq/2007/Jun/0063.html http://milw0rm.com/exploits/4035...

Comicsense 0.2 - 'index.php?epi' SQL Injection (2)

!/usr/bin/perl -w ComicSense 0.2 SQL Injection Exploit Discovered by: s0cratex Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Original Advisory: http://seclists.org/bugtraq/2007/Jun/0063.html http://milw0rm.com/exploits/4035 Vulnerable Code index.php: $sqlQuery = "SELECT...

Joomla! Component Phil-a-Form 1.2.0.0 - SQL Injection

Joomla! Component Phil-a-Form 1.2.0.0 - SQL Injection !/bin/sh Joomla Component Phil-a-Form = 1.2.0.0 SQL Injection Exploit Discovered by: Cody "CypherXero" Rester Payload: Admin Username and MD5 Hash Retrieval Website: http://www.cypherxero.net Shoutouts to the milw0rm community, the PIMP forums...

Dokeos 1.6.5 - courseLog.php?scormcontopen SQL Injection

Dokeos 1.6.5 - courseLog.php?scormcontopen SQL Injection !/usr/bin/perl -w Dokeos = 1.6.5 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code courseLog.php: if $GET'scormcontopen'...

TutorialCMS 1.01 - Authentication Bypass

TutorialCMS = 1.01 Authentication Bypass Discovered by: Silentz Payload: Authentication Bypass Website: http://www.w4ck1ng.com Vulnerability: Variables $loggedIn & $activated are not predefined. Vulnerable Files: login.php headerLinks.php submit1.php myFav.php userCP.php PoC:...

TutorialCMS 1.01 - Authentication Bypass

TutorialCMS 1.01 - Authentication Bypass TutorialCMS = 1.01 Authentication Bypass Discovered by: Silentz Payload: Authentication Bypass Website: http://www.w4ck1ng.com Vulnerability: Variables $loggedIn & $activated are not predefined. Vulnerable Files: login.php headerLinks.php submit1.php...

FAQEngine <= 4.16.03 (question.php questionref) SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w FAQEngine = v4.16.03 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code question.php: $sql = "select from ".$tableprefix."questions where publish=1 and...

FAQEngine <= 4.16.03 (question.php questionref) SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w FAQEngine = v4.16.03 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code question.php: $sql = "select from ".$tableprefix."questions where publish=1 and...

FAQEngine 4.16.03 - 'question.php?questionref' SQL Injection

!/usr/bin/perl -w FAQEngine = v4.16.03 SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code question.php: $sql = "select from ".$tableprefix."questions where publish=1 and questionref=$questionref order by enterdate...

CVE-2007-2677

CVE-2007-2677 affects phpChess Community Edition 2.0 with multiple PHP remote file inclusion vectors. The affected components are (1) config parameter to includes/language.php and (2)-(4) Root_Path/Parameters to layout_admin_cfg.php, layout_cfg.php, and layout_t_top.php in skins/phpchess/. The vu...

TaskDriver <= 1.2 Login Bypass/SQL Injection Exploit

Exploit for unknown platform in category web applications ==================================================== TaskDriver = 1.2 Login Bypass/SQL Injection Exploit ==================================================== !/usr/bin/perl -w TaskDriver = 1.2 Login Bypass/SQL Injection Exploit Discovered...

TutorialCMS <= 1.00 (search.php search) SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================= TutorialCMS alert'http://www.w4ck1ng.com' PoC: http://victim.com/search.php?search=' UNION SELECT 0,0,0,0,username, password,0,0,0,0,0,0,0 FROM users WHERE id='1' / Subject To:...

SimpleNews 1.0.0 FINAL - 'print.php?news_id' SQL Injection

!/usr/bin/perl -w SimpleNews = 1.0.0 FINAL SQL Injection Exploit Discovered by: Silentz Payload: Admin Username & Hash Retrieval Website: http://www.w4ck1ng.com Vulnerable Code print.php: $newsid = $GET'newsid'; $query = "SELECT FROM simplenewsarticles WHERE newsid = '$newsid'"; PoC:...