Cahier de texte 2.0 - Database Backup Source Disclosure

Cahier de texte 2.0 - Database Backup Source Disclosure !/usr/bin/perl INFORMATIONS ============ Affected.scr..: Cahier de texte V2.0 Poc.ID........: 15061124 Type..........: Predictable backup filename, Source disclosure Risk.level....: High Conditions....: registerglobals = on Src.download..:...

torrentflux 2.2 - Arbitrary File Create ExecuteDelete

torrentflux 2.2 - Arbitrary File Create ExecuteDelete r0ut3r Presents... Another r0ut3r discovery! TorrentFlux 2.2 Arbitrary File Creation/Overwrite/Deletion & Command Execution Vulnerablities Software: TorrentFlux 2.2 Vendor: http://www.torrentflux.com/ Released: 2006/11/15...

CVE-2006-3487

VirtuaStore 2.0 stores sensitive files under the web root with insufficient access control, which allows remote attackers to obtain local database information by directly accessing database/virtuastore.mdb...

CVE-2006-3104

users/index.php in Bitweaver 1.3 allows remote attackers to obtain sensitive information via an invalid sortmode parameter, which reveals the installation path and database information in the resultant error message...

Sql injection

Multiple SQL injection vulnerabilities in Hinton Design phphd 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the username parameter to check.php or 2 unknown attack vectors to scripts that display information from the database...

IPBProArcade 2.5 - SQL Injection

source: https://www.securityfocus.com/bid/11719/info A remote SQL injection vulnerability reportedly affects ipbProArcade. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query. An attacker may leverage this issue to...

Invision Power Board 2.0 - index.php Post Action SQL Injection

Invision Power Board 2.0 - index.php Post Action SQL Injection source: https://www.securityfocus.com/bid/11703/info A remote SQL injection vulnerability affects Inivision Power Board. This issue is due to a failure of the application to properly validate user-supplied input prior to using it in a...

Edikon Release 0.6 of PHPShop

Product : Edikon Release 0.6 of PHPShop Version : 0.6.1 WebSite : http://www.phpshop.org Problem : Viewing dbase information Description: ------------ eng In phpShop we can get access to a database of the server as the file of a configuration is accessible to each user. As we can find out a full...

Voxel Dot Net CBms 0.x - Multiple Code Injection Vulnerabilities

Voxel Dot Net CBms 0.x - Multiple Code Injection Vulnerabilities source: https://www.securityfocus.com/bid/4957/info It has been reported that multiple vulnerabilities exist in CBMS. Reportedly, it is possible to inject both JavaScript and SQL code into the system. It may be possible to execute...

iScouter PHP Web Portal System, MySQL Password in clear text

Hi all, I have found that i can easily retrieve MySQL password of the last iScouter PHP Web Portal System. Exploit : www.your-iScouter-web-portal.com/config.inc You can find those lines in clear text: $CFGDBSERVERTYPE = "mySQL"; $CFGDBHOST = "www.your-iScouter-web-portal.com"; $CFGDBUSERNAME =...

IBM NetCommerce Security

hola friends, while i was participating on the openhack contest i found a couple of serious security-holes within ibm s so called "netcommerce" thing which seems to be a mixture of websphere, net.data, servlets, jsp s and db2? however..summary: class: input validation error remote: yes local: yes...