Baran CMS 1.0 - Arbitrary .ASP File Upload File Disclosure SQL Injection Cross-Site Scripting Cookie Manipulation

Baran CMS 1.0 - Arbitrary .ASP File Upload File Disclosure SQL Injection Cross-Site Scripting Cookie Manipulation 0x01 Informations : Name : Baran Cms Version : 1.0 Personal site : http://www.baran-cms.ir $$ : 50$ Vul : Arbitrary ASP File Upload/DB/SQL/XSS/CM Credit : Aria-Security Team Website :...

Authentication flaw

win/content/upload.php in Goople CMS 1.7 allows remote attackers to bypass authentication and gain administrative access by setting the loggedin cookie to 1...

CVE-2008-6009

SG Real Estate Portal 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the Auth cookie to 1...

ConPresso CMS 4.07 Session Fixation / XSS

HACKATTACK Advisory 25012009ConPresso CMS 4.07 - Session Fixation, XFS, XSS Details Product: ConPresso CMS 4.07 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.conpresso.de/ Vendor-Status: informed Advisory-Status: not yet published Credits Discovered by: David Vieira-Kurz...

Rankem - File Disclosure Cross-Site Scripting Cookie

Rankem - File Disclosure Cross-Site Scripting Cookie --------------------------------------------------------- Portal Name: RankEm Download : http://www.katywhitton.com/downloads/rankEm/rankEmDL.zip Author : PouyaServer , [email protected] Vulnerability : DD/XSS/CM...

[HACKATTACK Advisory 20081203]Pro Clan Manager 0.4.2 - Session Fixation

HACKATTACK Advisory 20081203Pro Clan Manager 0.4.2 - Session Fixation Details Product: Pro Clan Manager CMS Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.proclanmanager.com/ Vendor-Status: informed Advisory-Status: not yet published Credits Discovered by: David Vieira-Kurz...

preonline-cmsqlxss.txt

--------------------------------------------------------- Portal Name: Pre Online Tests Generator Vendor : http://www.preproject.com Author : PouyaServer , [email protected] Vulnerability : SQL,CM,XSS --------------------------------------------------------- SQL:...

phpjobwebsite-cmsqlxss.txt

--------------------------------------------------------- Portal Name: PHP JOBWEBSITE PRO Vendor : http://preproject.com Author : PouyaServer , [email protected] Vulnerability : CM,XSS,SQL --------------------------------------------------------- SQL:...

preaspjob-xsscm.txt

--------------------------------------------------------- Portal Name: PRE ASP Job Board Vendor : http://www.preproject.com Author : PouyaServer , [email protected] Vulnerability : CM,XSS --------------------------------------------------------- XSS:...

RakhiSoftware Shopping Cart - PHPSESSID Cookie Manipulation Full Path Disclosure

source: https://www.securityfocus.com/bid/32563/info RakhiSoftware Shopping Cart is prone to multiple remote vulnerabilities. Exploiting these issues can allow attackers to obtain sensitive information, steal cookie data, access or modify data, or exploit latent vulnerabilities in the underlying...

RakhiSoftware Shopping Cart - PHPSESSID Cookie Manipulation Full Path Disclosure

RakhiSoftware Shopping Cart - PHPSESSID Cookie Manipulation Full Path Disclosure source: https://www.securityfocus.com/bid/32563/info RakhiSoftware Shopping Cart is prone to multiple remote vulnerabilities. Exploiting these issues can allow attackers to obtain sensitive information, steal cookie...

[HACKATTACK Advisory 20081127]Social Impress CMS 1.1 - Session Fixation

HACKATTACK Advisory 3Social Impress CMS 1.1 - Session Fixation Details Product: Impress CMS Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.impresscms.info Vendor-Status: informed Advisory-Status: not yet published Credits Discovered by: David Vieira-Kurz...

social-sql.txt

HACKATTACK Advisory 2008-11-20Social Engine 2.7 CRLF Injection + SQL injection Details Product: Social Engine Security-Risk: moderate Remote-Exploit: yes Vendor-URL: http://www.socialengine.net/ Vendor-Status: informed Advisory-Status: published Credits Discovered by: David Vieira-Kurz of...

cnn-xss.txt

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear CNN, I recently discovered a security vulnerability on the www.cnn.com website. I believe the vulnerability can be used by a remote user to alter content on www.cnn.com. On 10 Nov 2008, I wrote to...

fes-rficookie.txt

+-----------------+-----------------+-----------------+ 2. +-----------------+Fresh Email Script+----------------+ 3. +-----------------versions: 1.0 to 1.11 - all 4. +-----------------exploits: file inclusion & cookie manipulation 5. +-----------------founder: Don 6. +-----------------date:...

Fresh Email Script 1.0 Multiple Remote Vulnerabilities

No description provided by source. 1. +-----------------+-----------------+-----------------+ 2. +-----------------+Fresh Email Script+----------------+ 3. +-----------------versions: 1.0 to 1.11 - all 4. +-----------------exploits: file inclusion & cookie manipulation 5. +-----------------founde...

Fresh Email Script 1.0 Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ====================================================== Fresh Email Script 1.0 Multiple Remote Vulnerabilities ====================================================== 1. +-----------------+-----------------+-----------------+ 2...

fresh email script 1.0 - Multiple Vulnerabilities

fresh email script 1.0 - Multiple Vulnerabilities 1. +-----------------+-----------------+-----------------+ 2. +-----------------+Fresh Email Script+----------------+ 3. +-----------------versions: 1.0 to 1.11 - all 4. +-----------------exploits: file inclusion & cookie manipulation 5...

fresh email script 1.0 - Multiple Vulnerabilities

+-----------------+-----------------+-----------------+ 2. +-----------------+Fresh Email Script+----------------+ 3. +-----------------versions: 1.0 to 1.11 - all 4. +-----------------exploits: file inclusion & cookie manipulation 5. +-----------------founder: Don 6. +-----------------date:...

Authentication flaw

aflog 1.01 allows remote attackers to bypass authentication and gain administrative access by setting the aflogautha cookie to "A" or "O" in 1 editdelete.php, 2 editcat.php, 3 editlock.php, and 4 editform.php...