PT-2020-14348

Name of the Vulnerable Software and Affected Versions Stash version 1.0.3 Description The issue allows SQL Injection via the downloadmp3.php API endpoint, specifically through the download parameter. Recommendations For Stash version 1.0.3, consider restricting access to the downloadmp3.php...

Stash 1.0.3 - Multiple SQL Injection Vulnerabilities

No description provided by source. Stash v1.0.3 Admin bypass / Remote File Disclosure AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : IRCRASH R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina Yazdanmehr Download :...

Sql injection

SQL injection vulnerability in Stash 1.0.3, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the 1 username parameter to admin/library/authenticate.php and the 2 download parameter to downloadmp3.php. NOTE: some of these details are obtained from thir...

Stash 1.0.3 - Multiple SQL Injections

Stash v1.0.3 Admin bypass / Remote File Disclosure AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : IRCRASH R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina Yazdanmehr Download :...