Cross site request forgery (csrf)

dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account...

CVE-2018-11126

dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account...

CVE-2018-11126

dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account...

CVE-2018-11126

DoorGets 7.0 is affected by a CSRF vulnerability in the DG-USER flow (dg-user/?controller=users&action=add) that can result in adding an administrator account. This CVE (CVE-2018-11126) is documented with CVSSv3 base score 8.8 (HIGH) and CVSSv2 base score 6.8 (MEDIUM). Connected records consisten...

CVE-2018-11126: Cross-Site Request Forgery (CSRF)

dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account...

PT-2018-10320

Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue concerns a CSRF problem in the dg-user/?controller=users&action=add API endpoint, which can lead to the addition of an administrator account. Recommendations For doorGets version 7.0, consider...

DoorGets CMS 7.0 Open Redirect

Title: Open Redirect DoorGets CMS Version: 7.0 vendor: https://github.com/doorgets/doorGets/ Tested on: Windows 64-bit Author: Rudra Sarkar @rudr4sarkar CVE: 2016-3726 1. Affected Param back= 2. Full URL http://127.0.0.1/dg-user/?controller=authentification&back=http%3A%2F%2Fexploitlab.ex%2F 3. G...

doorGets CMS 5.2 - SQL Injection Vulnerability

doorGets CMS 5.2 sql注入漏洞 虽然标题是5.2版本的，但厂商在漏洞公布后就修复了并且没有更新版本， 所以漏洞其实存在于5.1版本（下载了不同版本，实验证实） 漏洞存在于/doorgets/core/doorgetsFunctions.php文件中 --------省略部分代码 507: $id = $this-Controller-form'positiondown'-i'id'; $type = $this-Controller-form'positiondown'-i'type'; $pos =...

doorGets CMS - CSRF Vulnerability

No description provided by source. Title: Doorgets CSRF Vulnerability Author: n0pe Software Link: http://www.doorgets.com/ Download: http://www.doorgets.com/?sourcescms Tested: BackBox Linux 3 With this vulnerability you can change the configuration of the site. Proof of concept: html body form...

doorGets 6.0 Cross Site Scripting

============================================================== Title ...| doorGets 6.0 Multiple vulnerabilities Version .| doorGets 6.0 Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....| http://sourceforge.net ==============================================================...

doorGets CMS SQL injection vulnerability-vulnerability warning-the black bar safety net

Vulnerability version: doorGets CMS 5.2 Vulnerability description: CVE ID:CVE-2 0 1 4-1 4 5 9 doorGets CMS is a content management system. Since the transfer to"/dg-admin/index.php"script"positiondownid" HTTP POST parameters failed to adequately filtered, the attacker can access the management...

CVE-2014-1459

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

Sql injection

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

CVE-2014-1459

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

CVE-2014-1459

DoorGets CMS

PT-2014-4194

Name of the Vulnerable Software and Affected Versions doorGets CMS versions 5.2 and earlier Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the position down id parameter in the dg-admin/index.php file. This can be leveraged using CSRF to all...

SQL Injection in doorGets CMS

Advisory ID: HTB23197 Product: doorGets CMS Vendor: doorGets Vulnerable Versions: 5.2 and probably prior Tested Version: 5.2 Advisory Publication: January 15, 2014 without technical details Vendor Notification: January 15, 2014 Vendor Patch: January 15, 2014 Public Disclosure: February 5, 2014...

CVE-2014-1459: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in dg-admin/index.php in doorGets CMS 5.2 and earlier allows remote authenticated administrators to execute arbitrary SQL commands via the positiondownid parameter. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands...

doorGets CMS 5.2 - SQL Injection Vulnerability

Exploit for php platform in category web applications Advisory Details: High-Tech Bridge Security Research Lab discovered vulnerability in doorGets CMS, which can be exploited to perform SQL Injection attacks. 1 SQL Injection in doorGets CMS: CVE-2014-1459 The vulnerability exists due to...

doorGets CMS 5.2 - SQL Injection

doorGets CMS 5.2 - SQL Injection Advisory ID: HTB23197 Product: doorGets CMS Vendor: doorGets Vulnerable Versions: 5.2 and probably prior Tested Version: 5.2 Advisory Publication: January 15, 2014 without technical details Vendor Notification: January 15, 2014 Vendor Patch: January 15, 2014 Publi...