[Full-disclosure] Full Path Disclosure eqDKP 1.3.2c and prior

eqDKP 1.3.2c and prior 'compare' variable reveals the full path because eqdkp fails to properly sanitize user-supplied input Example: /path-to-eqdkp/listmembers.php?compare=00 Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored b...

CVE-2007-2716

Multiple cross-site scripting XSS vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTML via the show parameter to 1 listmembers.php and 2 stats.php. NOTE: some of these details are obtained from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTML via the show parameter to 1 listmembers.php and 2 stats.php. NOTE: some of these details are obtained from third party information...

CVE-2007-2716

CVE-2007-2716 describes multiple cross-site scripting (XSS) vulnerabilities in EQdkp 1.3.2c and earlier . The issue arises when an attacker can inject arbitrary script/HTML via the show parameter to listmembers.php and stats.php . The provided documents confirm the affected component and entry po...

CVE-2007-2716

Multiple cross-site scripting XSS vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTML via the show parameter to 1 listmembers.php and 2 stats.php. NOTE: some of these details are obtained from third party information...

[Full-disclosure] Cross-site Scripting in EQDKP 1.3.2c and prior

In listmembers.php, $show fails to properly sanitize user-supplied input. It's non persistent XSS :-/ Example: $path-to-eqdkp/listmembers.php?show=223E3Cplaintext3E kefka kefka at kevinbeardsucks.com Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.htm...

EQdkp 1.3.1 - Cross-Site Scripting

EQdkp 1.3.1 - Cross-Site Scripting source: https://www.securityfocus.com/bid/23951/info EQDKP is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browse...

EQdkp 1.3.1 - Cross-Site Scripting

source: https://www.securityfocus.com/bid/23951/info EQDKP is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

Design/Logic Flaw

EQdkp 1.3.1 and earlier authenticates administrative requests by verifying that the HTTP Referer header specifies an admin/ URL, which allows remote attackers to read or modify account names and passwords via a spoofed Referer...

CVE-2007-0760

CVE-2007-0760 affects EQdkp versions 1.3.1 and earlier. The vulnerability stems from authenticating administrative requests by checking the HTTP Referer for an admin/ URL, which enables remote attackers to read or modify account names and passwords through a spoofed Referer. The provided document...

CVE-2007-0760

EQdkp 1.3.1 and earlier authenticates administrative requests by verifying that the HTTP Referer header specifies an admin/ URL, which allows remote attackers to read or modify account names and passwords via a spoofed Referer...

EQdkp <= 1.3.1 (Referer Spoof) Remote Database Backup Vulnerability

No description provided by source. Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected] --------------------------------------------------------------------------------------------------------...

EQdkp <= 1.3.1 Referer Spoof to access to SQL Database

Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected] -------------------------------------------------------------------------------------------------------- Background: EQdkp is the largest DKP...

EQdkp 1.3.1 - Referer Spoof Remote Database Backup

EQdkp 1.3.1 - Referer Spoof Remote Database Backup Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected]...

EQdkp <= 1.3.1 (Referer Spoof) Remote Database Backup Vulnerability

Exploit for unknown platform in category web applications =================================================================== EQdkp = 1.3.1 Referer Spoof Remote Database Backup Vulnerability =================================================================== Title: EQdkp = 1.3.1 Referer Spoof to...

EQdkp 1.3.1 - 'Referer Spoof' Remote Database Backup

Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: "Powered by EQdkp" Author: Eight10 Contact: [email protected] -------------------------------------------------------------------------------------------------------- Background: EQdkp is the largest DKP...

CVE-2006-2256

PHP remote file inclusion vulnerability in includes/dbal.php in EQdkp 1.3.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the eqdkprootpath parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/dbal.php in EQdkp 1.3.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the eqdkprootpath parameter...

CVE-2006-2256

PHP remote file inclusion vulnerability in includes/dbal.php in EQdkp 1.3.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the eqdkprootpath parameter...

CVE-2006-2256

EQdkp 1.3.0 and earlier are affected by a PHP remote file inclusion in includes/dbal.php, exploitable via a URL supplied to the eqdkp_root_path parameter, allowing execution of arbitrary PHP code on the server. Root cause is improper handling of user-controlled URL input leading to inclusion of r...