humo-sql.txt

Title: humo.be SQL Injection vuln Description: The site www.humo.be a Belgian magazine has a page where people can vote on various things. This page, however, has an SQL Injection vulnerability. Author: Tosser E-mail: [email protected] Proof:...

MyWeb SQL injection vulnerability

Overview Groupware MyWeb contains a SQL injection vulnerability. Impact A remote attacker could view or modify the database contents. Solution None...

The rookie caught the chicken collection－mining chicken application-vulnerability warning-the black bar safety net

Keywords :enterprise post office, enterprise honour marketing network products categories feedback contact us bookmark this site Drop out: /db/com02. mdb Upload page:/upfilephoto. asp The default password is: admin/login. asp Keywords :flying over the company enterprise web site management system...

PHPizabi v0.848b C1 HFP3 Database Information Disclosure Vuln

Exploit for unknown platform in category web applications ============================================================= PHPizabi v0.848b C1 HFP3 Database Information Disclosure Vuln =============================================================...

flinx <= 1.3 (category.php id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================= flinx Exploit : Target.il/flinxpath/category.php?id=SQL-CODE tables and columns names = table : flinxcat columns : name / catid = table : flinxlink columns : name / url /...

WebWizForum暴露数据库漏洞

Web Wiz Forum是一款简单的论坛系统，使用ASP编写。支持access/mssql数据库.Web Wiz Forum存在暴露数据库漏洞可导致利用者通过%5c暴出论坛数据库的绝对路径及数据库名，从而导致数据库被下载危急论坛安全。 WebWizForum 7.01-7.7 升级程序 ：WebWizForum 7.8以上http://www.webwizforums.com/关闭服务器错误显示 http://www.example.com/bbs%5cforumtopics.asp?FID=%201...

CVE-2006-3780

CVE-2006-3780 affects Keyifweb Keyif Portal 2.0. The issue is insufficient access control that allows remote attackers to download sensitive database files exposed under the web root, via direct requests to (1) ANKET/anket.mdb, (2) HABER/keyifweb.mdb, (3) ASP/download.mdb, or (4) SAYAC/aktif.mdb ...

CVE-2006-3487

VirtuaStore 2.0 stores sensitive files under the web root with insufficient access control, which allows remote attackers to obtain local database information by directly accessing database/virtuastore.mdb...

xueBookSQL.txt

------------------------------------------------------ Nightmare TeAmZ Advisory 003 ------------------------------------------------------ Date - 11/2005 xueBook 1.0 Sql Injection AFFECTED PRODUCTS ================= xueBook 1.0 Guestbook...

PHPNews news.php prevnext Parameter SQL Injection

The remote host is running PHPNews, an open source news application written in PHP. The installed version of PHPNews is prone to a SQL injection attack due to its failure to sanitize user-supplied input via the 'prevnext' parameter of the 'news.php' script. An attacker can exploit this flaw to...

CVE-2004-2060

ASPRunner 2.4 stores the database under the web root in the db directory, which may allow remote attackers to obtain the database via a direct request to the database filename, which is predictable based on table and field names...

UblogXSS.txt

PersianHacker.NET 200503-11Ublog reload 1.0.4 and prior Multiple Vulnerbilities Date: 2005 03 Bug Number: 11 Ublog Ublog reload is a complete ASP weblog system. More info @: http://www.uapplication.com Discussion: -------------------- What are the bugs ? 1 Cross-Site Scripting that lets attackers...

[PersianHacker.NET 200503-11]Ublog reload 1.0.4 and prior Multiple Vulnerbilities

PersianHacker.NET 200503-11Ublog reload 1.0.4 and prior Multiple Vulnerbilities Date: 2005 03 Bug Number: 11 Ublog Ublog reload is a complete ASP weblog system. More info @: http://www.uapplication.com Discussion: -------------------- What are the bugs ? 1 Cross-Site Scripting that lets attackers...

EUVD-2005-0854

betaparticle blog bp blog stores the database under the web root, which allows remote attackers to obtain sensitive information via a direct request to 1 dbBlogMX.mdb for versions before 3.0, or 2 Blog.mdb for versions 3.0 and later. NOTE: it was later reported that vector 2 also affects versions...

Kayako eSupport 2.x - Ticket System Multiple SQL Injections

source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten compromise of software and database security properties. Possible...

Kayako eSupport 2.x - Ticket System Multiple SQL Injections

Kayako eSupport 2.x - Ticket System Multiple SQL Injections source: https://www.securityfocus.com/bid/12037/info Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities. These issues may collectively threaten compromise...

[NT] DUGallery Database disclosure

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2004-1724

The ReadMe First.txt file in PHP-Fusion 4.0 instructs users to set the permissions on the fusionadmin/dbbackups directory to world read/write/execute 777, which allows remote attackers to download or view database backups, which have easily guessable filenames and contain the administrator userna...

osTicket setup.php Accessibility

The target is running at least one instance of an improperly secured installation of osTicket and allows access to setup.php. Since that script does not require authenticated access, it is possible for an attacker to modify osTicket's configuration using a specially crafted call to setup.php to...

CVE-2003-1304

EarlyImpact ProductCart 1.0 through 2.0 stores database/EIPC.mdb under the web root with insufficient access control, which allows remote attackers to obtain sensitive database information via a direct request...