CVE-2012-6517

DiY-CMS 1.0 is affected by multiple XSS vulnerabilities allowing remote attackers to inject arbitrary script/HTML via (1) the question parameter to /modules/poll/add.php and (2) the question or (3) the answer parameter to /modules/poll/edit.php. The root cause is unsafe handling of input leading ...

CVE-2012-6518

CVE-2012-6518 is a CSRF vulnerability affecting DiY-CMS 1.0, where mod.php allows attackers to hijack administrator authentication by crafting requests to the poll module’s add action. The issue arises from insufficient CSRF protections in the poll creation workflow, enabling unauthorized actions...

CVE-2012-6517

Multiple cross-site scripting XSS vulnerabilities in DiY-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 question parameter to in /modules/poll/add.php or 2 question or 3 answer parameter to modules/poll/edit.php...

CVE-2012-6518

Cross-site request forgery CSRF vulnerability in mod.php in DiY-CMS 1.0 allows remote attackers to hijack the authentication of administrators for requests that create a poll via an add action to the poll module...

CVE-2012-6519

SQL injection vulnerability in modules/poll/index.php in DIY-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the start parameter to mod.php...

Sistem Biwes Multiple Vulnerability`

=================================================================== Sistem Biwes Multiple Vulnerability =================================================================== Author: eidelweiss @randyarios Product / software: SISTEM BIWES Vendor Site: http://sistembiwes.com/ Product Price: RM240 /...

CVE-2011-5140

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

CVE-2011-5140

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

Sql injection

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

CVE-2011-5140

Multiple SQL injection vulnerabilities in the blog module 1.0 for DiY-CMS allow remote attackers to execute arbitrary SQL commands via the 1 start parameter to a tags.php, b list.php, c index.php, d mainindex.php, e viewpost.php, f archive.php, g control/approvecomments.php, h...

CVE-2011-5140

Affected software: DiY-CMS blog module 1.0. Vulnerability type: SQL injection at multiple endpoints via the start parameter (tags.php, list.php, index.php, main_index.php, viewpost.php, archive.php) and via month/year parameters to archive.php; also affects control/approve_comments.php, control/a...

Sistem Biwes Multiple Vulnerability

Exploit for php platform in category web applications =================================================================== Sistem Biwes Multiple Vulnerability =================================================================== Google Dork: "Powered by sistembiwes.com" Author: eidelweiss @randyario...

Sistem Biwes SQL Injection / Path Disclosure

=================================================================== Sistem Biwes Multiple Vulnerability =================================================================== Author: eidelweiss @randyarios Product / software: SISTEM BIWES Vendor Site: http://sistembiwes.com/ Product Price: RM240 /...

DIY CMS 1.0 Poll - Multiple Vulnerabilities

DIY CMS 1.0 Poll - Multiple Vulnerabilities Title: ====== DIY CMS v1.0 Poll - Multiple Web Vulnerabilities Date: ===== 2012-04-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=518 VL-ID: ===== 518 Introduction: ============= Do It Yourslef Content Management System is...

DIY CMS 1.0 Poll - Multiple Vulnerabilities

Title: ====== DIY CMS v1.0 Poll - Multiple Web Vulnerabilities Date: ===== 2012-04-26 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=518 VL-ID: ===== 518 Introduction: ============= Do It Yourslef Content Management System is a feature-rich, php-built, mysql-based,...

DIY CMS v1.0 Poll - Multiple Web Vulnerabilities

Document Title: =============== DIY CMS v1.0 Poll - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=518 Release Date: ============= 2012-04-26 Vulnerability Laboratory ID VL-ID: ==================================== 518 Produc...

DIY CMS v1.0 Poll - Multiple Web Vulnerabilities

Document Title: =============== DIY CMS v1.0 Poll - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=518 Release Date: ============= 2012-04-26 Vulnerability Laboratory ID VL-ID: ==================================== 518 Produc...

DIY-CMS Blog Mod SQL Injection

Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: [email protected] Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG: http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=tags&tag=features&start=sqli...

DIY-CMS blog mod SQL Injection

Exploit for php platform in category web applications Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: email protected Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG:...

DIY-CMS blog mod - SQL Injection

DIY-CMS blog mod - SQL Injection Exploit Title: DIY-CMS blog mod SQL Injection Author: snup Contact: [email protected] Site: http://e-o-u.org SQL Injection: DORK: inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS" inurl:"mod.php?mod=blog" BUG:...