E-commerce Cross site scripting vulnerability

It is possible for a malicious user with the 'create products' permission to insert and execute XSS Cross Site Scripting, due to lack of validation on output. This may lead to administrator access if certain conditions are met. Learn more about XSS on Wikipedia. The create products permission is...

CVE-2006-3859

IBM Informix Dynamic Server IDS allows remote authenticated users to create and overwrite arbitrary files via the 1 LOTOFILE and 2 trltracefileset functions, and the 3 "SET DEBUG FILE" commands...

Oracle 10g - Alter Session Integer Overflow

Oracle 10g - Alter Session Integer Overflow source: https://www.securityfocus.com/bid/19201/info Oracle 10g is reportedly prone to a integer-overflow vulnerability because the application fails to allocate a large enough data type to accommodate user-supplied input before using it in a query. Thi...

CVE-2006-3764

Till Gerken phpPolls 1.0.3 allows remote attackers to create a new poll via a direct request to phpPollAdmin.php3 with the pollaction parameter set to create...

MyBulletinBoard (MyBB) 1.1.5 - 'CLIENT-IP' SQL Injection

!/usr/bin/php -q -d shortopentag=on ? echo "MyBulletinBoard MyBB = 1.1.5 'CLIENT-IP' SQL injection / create new admin exploit\n"; echo "by rgod [email protected]\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork, version specific: "Powered By MyBB" "2006 MyBB Group"\n\n"; / works...

phpPolls 1.0.3 Administration ByPass

SOFTWARE: ========= phpPolls 1.0.3 DESCRIPTION: ============ dork: phpPolls view.php3 add to last path phpPollAdmin.php3?pollaction=create create a new poll Credits:AlpEren and tugr@ Site: http://www.ayyildiz.org http://www.ayyildiz-team.org Special thanx to...

WinGate IMAP Server Directory Traversal Vulnerabilities

The remote host appears to be running WinGate, a Windows application for managing and securing Internet access. The version of WinGate installed on the remote host fails to remove directory traversal sequences from the 'CREATE', 'SELECT', 'DELETE', 'RENAME', 'COPY', 'APPEND', and 'LIST' commands...

MyBulletinBoard (MyBB) 1.1.3 - 'usercp.php' Create Admin

!/usr/bin/perl MyBulletinBoard MyBB new or die; $cookiejar = HTTP::Cookies-new; $xpl-cookiejar $cookiejar ; $res = $xpl-post$url.'member.php', Content = "action" = "dologin", "username" = "$uname", "password" = "$passwd", "submit" = "Login", ,; if$cookiejar-asstring = /mybbuser=.?;/ print...

DeluxeBB 1.07 - Remote Create Admin

!/usr/bin/perl DeluxeBB new or die; $cookiejar = HTTP::Cookies-new; $xpl-cookiejar $cookiejar ; $res = $xpl-post$url.'misc.php', Content = "sub" = "login", "name" = "$uname", "password" = "$passwd", "submit" = "Log-in", "redirect" = "", "expiry" = "990090909", ,; if$cookiejar-asstring =...

MyBulletinBoard (MyBB) 1.1.3 - usercp.php Create Admin

MyBulletinBoard MyBB 1.1.3 - usercp.php Create Admin !/usr/bin/perl MyBulletinBoard MyBB new or die; $cookiejar = HTTP::Cookies-new; $xpl-cookiejar $cookiejar ; $res = $xpl-post$url.'member.php', Content = "action" = "dologin", "username" = "$uname", "password" = "$passwd", "submit" = "Login", ,;...

DeluxeBB <= 1.07 (cp.php) Create Admin Exploit

No description provided by source. !/usr/bin/perl DeluxeBB = 1.07 Create Admin Exploit www.h4ckerz.com / www.hackerz.ir / www.aria-security.net ./2006-6-25 Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net use IO::Socket; use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $uname = $ARGV...

CVE-2006-2660

Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the...

MyBulletinBoard (MyBB) 1.1.3 - Remote Code Execution

MyBulletinBoard MyBB 1.1.3 - Remote Code Execution !/usr/bin/perl Tue Jun 13 12:37:12 CEST 2006 [email protected] Exploit HOWTO - read this before flood my Inbox you bitch! - First you need to create the special user to do this use: ./mybibi.pl --host=http://www.example.com --dir=/mybb -1 this st...

Directory traversal

Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages, create/rename arbitrary directories on the system, and delete empty directories via directory traversal sequences in the 1 CREATE, 2 SELECT, 3 DELETE, 4...

PHP-Nuke <= All Version Administrator SQL Injection Exploit / By WiLdBoY

PHP-Nuke = All Version Administrator SQL Injection Exploit / By WiLdBoY Credit : WiLdBoY Server Adress: Example : http://www.sitename.com Admin Name: Example : Admin Password MD5: Example : 1ea52f26e7e0ce08e462f87f5e35096c ------------------------------ User Information.... Name: Example : Michal...

DbbS<=2.0-alpha Multiple Vulnerabilities

Special thanks to rgod for his help!!! Full path disclosure http://www.site.com/DbbS/topics.php?fcategoryid=' http://www.site.com/DbbS/script.php?unavariabile= http://www.site.com/DbbS/script.php?GLOBALS= http://www.site.com/DbbS/script.php?SERVER= MD5 Password...

JiRos Banner Experience 1.0 (Create Admin Bypass) Remote Exploit

Exploit for unknown platform in category web applications ================================================================ JiRos Banner Experience 1.0 Create Admin Bypass Remote Exploit ================================================================ Jiros Banner Experience Pro Unauthorized Admin...

DEBIAN-CVE-2006-1063

Unspecified vulnerability in Lurker 2.0 and earlier allows remote attackers to create or overwrite files in any writable directory that is named "mbox"...

Code injection

Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the "31" parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due...

Directory traversal

Directory traversal vulnerability in the IMAP server in ArGoSoft Mail Server Pro 1.8.8.1 allows remote authenticated users to create arbitrary folders via a .. dot dot in the RENAME command...