e107 Persistant XSS vulnerability

Exploit for php platform in category web applications Exploit Title: E107 CMS Persistant XSS vulnerability Google Dork: "intitle:e107 powered website" | inurl:e107admin | ... Date: 18/02/2013 Exploit Author: Zyklon B Vendor Homepage: http://e107.org/ Software Link:...

e107 Image Manager Unauthorized File Upload

The version of e107 installed on the remove host is affected by a file upload vulnerability that could allow remote, unauthenticated attackers to upload arbitrary files on the remote host. An attacker may exploit this flaw to upload a PHP file to the remote host containing arbitrary code and then...

CVE-2012-6433

Cross-site request forgery CSRF vulnerability in e107admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the newstitle parameter in a create action...

CVE-2012-6434

Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in e107admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the newstitle parameter in a create action...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...

CVE-2012-6433

Cross-site request forgery CSRF vulnerability in e107admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the newstitle parameter in a create action...

CVE-2012-6433

CVE-2012-6433 affects e107 1.0.1, specifically the /e107_admin/newspost.php?create action. The vulnerability is a Cross-Site Request Forgery (CSRF) that can allow an attacker to hijack an administrator’s session and trigger actions that lead to arbitrary JavaScript execution (XSS via the news_tit...

CVE-2012-6434

CVE-2012-6434 affects e107 1.0.2: CSRF in e107_admin/download.php enables an attacker to hijack administrator sessions and perform SQL injection via parameters such as download_url, download_url_extended, download_author_email, download_author_website, download_image, download_thumb, download_vis...

CVE-2012-6434

Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...

PT-2013-1943

Name of the Vulnerable Software and Affected Versions e107 version 1.0.2 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks. This is achieved through multiple cross-site request forgery CSRF vulnerabilities ...

PT-2013-1942

Name of the Vulnerable Software and Affected Versions e107 version 1.0.1 Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that conduct XSS attacks via the news title parameter in a create action. Recommendations For e107...

CVE-2012-6434: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...

CVE-2012-6433: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in e107admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the newstitle parameter in a create action...

e107 v1.0.1 CSRF Resulting in Arbitrary Javascript Execution

Exploit for php platform in category web applications Exploit Title: e107 v1.0.1 Administrator CSRF Resulting in Arbitrary Javascript Execution Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...

e107 v1.0.2 CSRF Resulting in SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: e107 v1.0.2 Administrator CSRF Resulting in SQL Injection Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...

e107 1.0.2 - SQL Injection (via Cross-Site Request Forgery)

e107 1.0.2 - SQL Injection via Cross-Site Request Forgery Exploit Title: e107 v1.0.2 Administrator CSRF Resulting in SQL Injection Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...

e107 1.0.2 - SQL Injection (via Cross-Site Request Forgery)

Exploit Title: e107 v1.0.2 Administrator CSRF Resulting in SQL Injection Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...

e107 1.0.1 - Arbitrary JavaScript Execution (via Cross-Site Request Forgery)

Exploit Title: e107 v1.0.1 Administrator CSRF Resulting in Arbitrary Javascript Execution Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...

e107 1.0.2 Administrator Cross Site Request Forgery

Exploit Title: e107 v1.0.2 Administrator CSRF Resulting in SQL Injection Google Dork: intext:"This site is powered by e107" Date: 01/01/13 Exploit Author: Joshua Reynolds Vendor Homepage: http://e107.org Software Link:...