WikiWebHelp v0.3.3 Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications =========================================================== WikiWebHelp v0.3.3 Cross-Site Request Forgery Vulnerability =========================================================== Blog: yoyahack.blogspot.com Site: foro.undersecurity.net Mail:...

WikiWebHelp 0.3.3 - Cross-Site Request Forgery

WikiWebHelp 0.3.3 - Cross-Site Request Forgery Blog: yoyahack.blogspot.com Site: foro.undersecurity.net Mail: [email protected] CMS: WikiWebHelp The entire system is vulnerable to CSRF Cross-site request forgery since this does not include a system to prevent CSRF attacks ... Example...

Mod-X Cross Site Request Forgery / Cross Site Scripting

Got bored and decided to break the new website of the company I work for. Throughout I'll be dropping two new exploits that were chained to allow the changing of the administrative password of a default mod-x install. This is not a full review of mod-x, my main goal was just to break something, s...

CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack

CVE-2010-2234: Apache CouchDB Cross Site Request Forgery Attack Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache CouchDB 0.8.0 to 0.11.0 Description: Apache CouchDB versions prior to version 0.11.1 are vulnerable to cross site request forgery CSRF attacks...

eXtreme Message Board 1.9.11 Cross Site Request Forgery

Date: Thu 15 Jul 2010 12:08:07 PM EEST Vendor: http://www.xmbforum.com/ Download: http://www.xmbforum.com/download/XMB-1.9.11.09.zip --- -= CSRF PoC 1 - Change Admin Password =- -= Method 1 - editprofile.php =- eXtreme Message Board 1.9.11 Multiple CSRF Vulnerabilities - Change Admin Password -=...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter...

Allomani Songs & Clips 2.7.0 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Allomani & Clips v2.7.0 - CSRF Add Admin Account Date:25 -06-2010 Author: G0D-F4Th3rG0D-F4Th3r Software Link: http://allomani.com Greetz to : AL-MoGrM - dEvIL NeT - Bad hacker - v4-team members - And All My Friends...

Traidnt Discovery Cross Site Request Forgery

Exploit Title: Traidnt Discovery - CSRF/Change Username & Password Staff Account Date: 16-06-2010 Author: G0D-F4Th3r Software Link: http://discovery.traidnt.com/demo/ Version: 1.0 ====================================form================================================ /ht...

Planet 1.1 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Planet 1.1 - CSRF Add Admin Account Date: 17-06-2010 Author: G0D-F4Th3r Software Link: http://php.femtolayer.com/planet11/ Version: 1.1 Tested on: http://php.femtolayer.com/planet11/ /cp/security.php?do=admins" Greetz to : AL-MoGrM - dEvIL NeT - Bad hacker - v4-team members - And A...

PHPplanner PHP Planner 0.4 - Multiple Vulnerabilities

Title: phpplanner = PHP Planner v.0.4 Multiple Vulnerabilities Date: 13/05/10 Author: cp77fk4r | empty0pageSHIFT+2gmail.com | www.DigitalWhisper.co.il Software Link: http://phpplanner.sourceforge.net/ Version: = v.0.4 Tested on: PHP Full Path Disclosure Full Path Disclosure FPD vulnerabilities...

Comersus 8 Shopping Cart Cross Site Request Forgery / SQL Injection

Exploit Title:SQL Injection and CSRF Vulnerability in Comersus 8 Shopping Cart Version: Web Application vendor :http://www.comersus.com/index.html Date: 1 apr,2010 Author:Sid3^effects Code : -------------------------------------------------------------------------------------- Sid3^effects aKa Ha...

Comersus 8 Shopping Cart - SQL Injection / Cross-Site Request Forgery

Exploit Title:SQL Injection and CSRF Vulnerability in Comersus 8 Shopping Cart Version: Web Application vendor :http://www.comersus.com/index.html Date: 1 apr,2010 Author:Sid3^effects Code : -------------------------------------------------------------------------------------- Sid3^effects aKa Ha...

CVE-2009-2936

The Command Line Interface aka Server CLI or administration interface in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to 1 execute arbitrary code via a vcl.inline...

DEBIAN-CVE-2009-2936

The Command Line Interface aka Server CLI or administration interface in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to 1 execute arbitrary code via a vcl.inline...

CVE-2010-1227

Cross-site scripting XSS vulnerability in Sun Java System Communications Express 6.2 and 6.3 allows remote attackers to inject arbitrary web script or HTML via the subject field of a message, as demonstrated by a subject containing an IMG element with a SRC attribute that performs a cross-site...

CVE-2010-1227

Cross-site scripting XSS vulnerability in Sun Java System Communications Express 6.2 and 6.3 allows remote attackers to inject arbitrary web script or HTML via the subject field of a message, as demonstrated by a subject containing an IMG element with a SRC attribute that performs a cross-site...

Sun Java System Communications Express XSRF

Hello, As a continuation of my advisory about "Sun Java System Communications Express Multiple HTML Injection Vulnerabilities" that can be found here: http://www.securityfocus.com/bid/34083/info, I would like to introduce another potential security threat in the same product and based on my...

Tinypug 0.9.5 - Cross-Site Request Forgery (Password Change)

www.BugReport.ir AmnPardaz Security Research Team Title: Tinypug Multiple Vulnerabilities Vendor: http://platformassociates.com/ project hosted at http://code.google.com/p/tinypug/ Vulnerable Version: 0.9.5 and prior versions Exploitation: Remote with browser Fix: N/A - Description: Tinypug is a...

Huawei HG510 Cross Site Request Forgery

Hello, Huawei HG510 is a device offered by the Serbian telecom operator, to provide ADSL Internet connection. Administration of settings on this device is allowed only from local LAN network but not only from private IP address eg 192.168.1.1 then You can access with public IP address only from...

phpMyAdmin setup.php unserialize() Arbitrary PHP Code Execution (PMASA-2010-3)

The setup script included with the version of phpMyAdmin installed on the remote host does not properly sanitize user-supplied input before using it to generate a config file for the application. Submitting a specially crafted POST request can result in arbitrary PHP code injection. A remote...