phpBB-Auction 1.x - auction_room.php?ar SQL Injection

phpBB-Auction 1.x - auctionroom.php?ar SQL Injection source: https://www.securityfocus.com/bid/19179/info PHPBB-Auction is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. These vulnerabilities...

phpBB-Auction 1.x - auction_store.php?u SQL Injection

phpBB-Auction 1.x - auctionstore.php?u SQL Injection source: https://www.securityfocus.com/bid/19179/info PHPBB-Auction is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. These vulnerabilities...

phpBB-Auction 1.x - 'auction_store.php?u' SQL Injection

source: https://www.securityfocus.com/bid/19179/info PHPBB-Auction is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. These vulnerabilities could permit remote attackers to pass malicious input...

Invision Power Board classes/class_session.php CLIENT_IP HTTP Header SQL Injection

According to its banner, the installation of Invision Power Board on the remote host reportedly fails to sanitize input to the 'CLIENTIP' HTTP request header before using it in database queries. An unauthenticated attacker may be able to leverage this issue to disclose sensitive information, modi...

Scout Portal Toolkit SPT--ForumTopics.php forumid Parameter SQL Injection

The remote host is running Scout Portal Toolkit, an open source toolkit for organizing collections of online resources / knowledge. The version of Scout Portal Toolkit installed on the remote host fails to sanitize user-supplied input to the 'forumid' parameter to the 'SPT--ForumTopics.php' scrip...

Calendarix Multiple Script id Parameter SQL Injection

The remote host is running Calendarix, a free web-based calendar application written in PHP. The version of Calendarix installed on the remote host fails to sanitize input to the 'id' parameter to the 'calevent.php' and 'calpopup.php' scripts before using it in database queries. Provided PHP's...

Pixelpost index.php category Parameter SQL Injection

The remote host is running Pixelpost, a photo blog application based on PHP and MySQL. The version of Pixelpost installed on the remote fails to sanitize user-supplied input to the 'category' parameter of the 'index.php' script before using it to construct database queries. Provided PHP's...

sBLOG search.php keyword Parameter SQL Injection

The remote host is running sBLOG, a PHP-based blog application. The installed version of sBLOG fails to validate user input to the 'keyword' parameter of the 'search.php' script before using it to generate database queries. Regardless of PHP's 'magicquotesgpc' setting, an unauthenticated attacker...

Mambo Open Source Multiple Vulnerabilities

The remote installation of Mambo Open Source fails to sanitize input to the 'mosusertemplate' cookie before using it to include PHP code from a local file. An unauthenticated attacker may be able to exploit this issue to view arbitrary files or to execute arbitrary PHP code on the affected host. ...

phpWebThings forum Parameter SQL Injection Vulnerabilities

The remote web server contains a PHP script that is prone to SQL injection attacks. Description : The remote host is running the phpWebThings application framework. The version of phpWebThings installed on the remote host does not properly sanitize user input in the 'forum' and 'msg' parameters o...

LoudBlog 0.41 - podcast.php SQL Injection

LoudBlog 0.41 - podcast.php SQL Injection source: https://www.securityfocus.com/bid/17023/info Loudblog is prone to multiple input-validation vulnerabilities: - An SQL-injection vulnerability. - Two local file-include vulnerabilities. - An information-disclosure vulnerability. These issues allow...

LoudBlog 0.41 - 'index.php?template' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/17023/info Loudblog is prone to multiple input-validation vulnerabilities: - An SQL-injection vulnerability. - Two local file-include vulnerabilities. - An information-disclosure vulnerability. These issues allow remote attackers to execute arbitrary PHP...

LoudBlog 0.41 - backend_settings.php Traversal Arbitrary File Access

LoudBlog 0.41 - backendsettings.php Traversal Arbitrary File Access source: https://www.securityfocus.com/bid/17023/info Loudblog is prone to multiple input-validation vulnerabilities: - An SQL-injection vulnerability. - Two local file-include vulnerabilities. - An information-disclosure...

LoudBlog 0.41 - 'backend_settings.php' Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/17023/info Loudblog is prone to multiple input-validation vulnerabilities: - An SQL-injection vulnerability. - Two local file-include vulnerabilities. - An information-disclosure vulnerability. These issues allow remote attackers to execute arbitrary PHP...

LoudBlog 0.41 - 'podcast.php' SQL Injection

source: https://www.securityfocus.com/bid/17023/info Loudblog is prone to multiple input-validation vulnerabilities: - An SQL-injection vulnerability. - Two local file-include vulnerabilities. - An information-disclosure vulnerability. These issues allow remote attackers to execute arbitrary PHP...

ADOdb server.php sql Parameter SQL Injection

The remote host is running ADOdb, a database abstraction library for PHP. The installed version of ADOdb includes a test script named 'server.php' that fails to sanitize user input to the 'sql' parameter before using it in database queries. An attacker can exploit this issue to launch SQL injecti...

LocazoList Classifieds 1.0 - 'SearchDB.asp' Input Validation

source: https://www.securityfocus.com/bid/15812/info LocazoList Classifieds is prone to an input validation vulnerability that allows cross-site scripting and SQL injection attacks. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user i...

Magic Forum Personal - view_forum.cfm?ForumID SQL Injection

Magic Forum Personal - viewforum.cfm?ForumID SQL Injection source: https://www.securityfocus.com/bid/15774/info CFMagic Products are prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input. These vulnerabilities allow an attacker t...

Magic List Pro - view_archive.cfm?ListID SQL Injection

Magic List Pro - viewarchive.cfm?ListID SQL Injection source: https://www.securityfocus.com/bid/15774/info CFMagic Products are prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input. These vulnerabilities allow an attacker to...

Magic Forum Personal - 'view_thread.cfm' Multiple SQL Injections

source: https://www.securityfocus.com/bid/15774/info CFMagic Products are prone to multiple input validation vulnerabilities. These are due to a lack of proper sanitization of user-supplied input. These vulnerabilities allow an attacker to inject malicious SQL code into database queries, and...