CVE-2013-2750

CVE-2013-2750 is an XSS in e107, specifically in e107_plugins/content/handlers/content_preset.php, exploitable when user-supplied input in GET parameters is not properly sanitized (notably via %00/%0d%0a sequences). Affected product: e107 prior to 1.0.3. Impact as described: remote attacker can i...

e107 Advanced Medal System Plugin - SQL Injection

e107 Advanced Medal System Plugin - SQL Injection Exploit Title: Advanced Medal System SQL Injection Google Dork: inurl:advmedsysview.php Date: 6/18/13 Exploit Author: Life Wasted and Caspa Vendor Homepage: http://e107.org/e107plugins/psilo/list.php?mode=plugin&id=699 Software Link:...

e107 Advanced Medal System Plugin - SQL Injection

Exploit Title: Advanced Medal System SQL Injection Google Dork: inurl:advmedsysview.php Date: 6/18/13 Exploit Author: Life Wasted and Caspa Vendor Homepage: http://e107.org/e107plugins/psilo/list.php?mode=plugin&id=699 Software Link: http://e107.org/e107plugins/psilo/psilo.php?download.699 Versio...

e107 content_preset.php URI XSS

The version of e107 installed on the remote host is affected by a cross-site scripting vulnerability because it fails to properly sanitize user input passed in the URI to the 'contentpreset.php' script. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user'...

TC-SA-2013-01: Reflected Cross-Site-Scripting (XSS) vulnerability in e107 CMS v1.0.2

TC-SA-2013-01: Reflected Cross-Site-Scripting XSS vulnerability in e107 CMS v1.0.2 Published: 2013/04/03 Version 1.0 Affected Products: e107 version 1.0.2 others not tested http://www.e107.org References: TC-SA-2013-01 www.tele-consulting.com/advisories/TC-SA-2013-01.txt used for updates...

e107 'content_preset.php'跨站脚本漏洞(CVE-2013-2750)

Bugtraq ID:58841 CVE ID:CVE-2013-2750 e107是一款内容管理系统。 e107没有正确过滤GET参数中"%00"组合"%0d%0a"的字符输入，允许远程攻击者利用漏洞进行跨站脚本攻击，可获得敏感信息或劫持用户会话。 0 e107 v1.0.2 厂商解决方案 e107 v1.0.3已经修复此漏洞，建议用户下载更新： http://e107.org/ http://host/e107plugins/content/handlers/contentpreset.php? %3c%00script%0d%0aalert'reflexted%20XSS'/scr...

e107 CMS 1.0.2 Cross Site Scripting

TC-SA-2013-01: Reflected Cross-Site-Scripting XSS vulnerability in e107 CMS v1.0.2 Published: 2013/04/03 Version 1.0 Affected Products: e107 version 1.0.2 others not tested http://www.e107.org References: TC-SA-2013-01 www.tele-consulting.com/advisories/TC-SA-2013-01.txt used for updates...

e107 - content_preset.php Cross-Site Scripting

e107 - contentpreset.php Cross-Site Scripting source: https://www.securityfocus.com/bid/58841/info e107 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser o...

e107 - 'content_preset.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/58841/info e107 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

e107 Persistant XSS vulnerability

Exploit for php platform in category web applications Exploit Title: E107 CMS Persistant XSS vulnerability Google Dork: "intitle:e107 powered website" | inurl:e107admin | ... Date: 18/02/2013 Exploit Author: Zyklon B Vendor Homepage: http://e107.org/ Software Link:...

e107 Image Manager Unauthorized File Upload

The version of e107 installed on the remove host is affected by a file upload vulnerability that could allow remote, unauthenticated attackers to upload arbitrary files on the remote host. An attacker may exploit this flaw to upload a PHP file to the remote host containing arbitrary code and then...

CVE-2012-6434

Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...

CVE-2012-6433

Cross-site request forgery CSRF vulnerability in e107admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the newstitle parameter in a create action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in e107admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the newstitle parameter in a create action...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...

CVE-2012-6434

Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...

CVE-2012-6433

CVE-2012-6433 affects e107 1.0.1, specifically the /e107_admin/newspost.php?create action. The vulnerability is a Cross-Site Request Forgery (CSRF) that can allow an attacker to hijack an administrator’s session and trigger actions that lead to arbitrary JavaScript execution (XSS via the news_tit...

CVE-2012-6433

Cross-site request forgery CSRF vulnerability in e107admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the newstitle parameter in a create action...

CVE-2012-6434

CVE-2012-6434 affects e107 1.0.2: CSRF in e107_admin/download.php enables an attacker to hijack administrator sessions and perform SQL injection via parameters such as download_url, download_url_extended, download_author_email, download_author_website, download_image, download_thumb, download_vis...

e107 v1.0.1 CSRF Resulting in Arbitrary Javascript Execution

Exploit for php platform in category web applications Exploit Title: e107 v1.0.1 Administrator CSRF Resulting in Arbitrary Javascript Execution Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...