PT-2013-1981

Name of the Vulnerable Software and Affected Versions DiY-CMS version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the question parameter to /modules/poll/add.php or the question or answer parameters to /modules/poll/edit.php...

PT-2013-1983

Name of the Vulnerable Software and Affected Versions DIY-CMS version 1.0 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by manipulating the start parameter to mod.php. Recommendations For DIY-CMS version 1.0, consider restricting...

PT-2013-1982

Name of the Vulnerable Software and Affected Versions DiY-CMS version 1.0 Description A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that create a poll via an add action to the poll module. Recommendations For DiY-CMS versi...

CVE-2012-6519: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php...

CVE-2012-6518: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module...

CVE-2012-6517: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 question parameter to in /modules/poll/add.php or 2 question or 3 answer parameter to modules/poll/edit.php...

CVE-2011-5140

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

Sql injection

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

CVE-2011-5140

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

CVE-2011-5140

Affected software: DiY-CMS blog module 1.0. Vulnerability type: SQL injection at multiple endpoints via the start parameter (tags.php, list.php, index.php, main_index.php, viewpost.php, archive.php) and via month/year parameters to archive.php; also affects control/approve_comments.php, control/a...

PT-2012-2118

Name of the Vulnerable Software and Affected Versions DiY-CMS blog module version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the start parameter to various API endpoints, including "tags.php", "list.php", "index.php", "main index.php"...

CVE-2011-5140: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

DIY CMS 1.0 Poll - Multiple Vulnerabilities

DIY CMS 1.0 Poll - Multiple Vulnerabilities Title: ====== DIY CMS v1.0 Poll - Multiple Web Vulnerabilities Date: ===== 2012-04-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=518 VL-ID: ===== 518 Introduction: ============= Do It Yourslef Content Management System is...

DIY CMS 1.0 Poll - Multiple Vulnerabilities

Title: ====== DIY CMS v1.0 Poll - Multiple Web Vulnerabilities Date: ===== 2012-04-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=518 VL-ID: ===== 518 Introduction: ============= Do It Yourslef Content Management System is a feature-rich, php-built, mysql-based,...

DIY CMS v1.0 Poll - Multiple Web Vulnerabilities

Document Title: =============== DIY CMS v1.0 Poll - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=518 Release Date: ============= 2012-04-26 Vulnerability Laboratory ID VL-ID: ==================================== 518 Produc...

DIY-CMS Blog Mod SQL Injection

Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: [email protected] Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG: http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=tags&tag=features&start=sqli...

DIY-CMS blog mod - SQL Injection

DIY-CMS blog mod - SQL Injection Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: [email protected] Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG:...

DIY-CMS blog mod SQL Injection

Exploit for php platform in category web applications Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: email protected Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG:...

DIY-CMS blog mod - SQL Injection

Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: [email protected] Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG: http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=tags&tag=features&start=sqli...

DiY-CMS Multiple Remote File Inclusion Vulnerabilities

DiY-CMS is prone to multiple remote file inclusion vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...