70 matches found
eTicket 'pri' SQL注入漏洞
BUGTRAQ ID: 29973 CNCAN ID：CNCAN-2008063005 eTicket是一款基于PHP的WEB应用程序。 eTicket不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或操作数据库。 问题是脚本对用户提交的'pri'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 eTicket 1.5.7 厂商解决方案 升级到eTicket 1.7： http://www.eticketsupport.com/announcements/170isinthebuilding-t91.0.ht...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in eTicket 1.5.6-RC4 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...
CVE-2008-0552
Cross-site scripting XSS vulnerability in index.php in eTicket 1.5.6-RC4 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...
CVE-2008-0552
CVE-2008-0552 is an XSS vulnerability in index.php of eTicket 1.5.6-RC4 that allows remote attackers to inject arbitrary script/HTML via PATH_INFO. Documented by NVD and multiple sources; CVSS v2 base score 4.3 (medium). No exploitation details or remediation are provided in the connected documen...
CVE-2008-0552
Cross-site scripting XSS vulnerability in index.php in eTicket 1.5.6-RC4 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...
eTicket 'index.php' Cross Site Scripting Path Vulnerability
eTicket 'index.php' Cross Site Scripting Path Vulnerability Name: eTicket 'index.php' Cross Site Scripting Path Vulnerability Application: eTicket Versions Affected: 1.5.6-RC4 Severity: Medium Vendor: eTicket, http://sourceforge.net/projects/eticket Bug: XSS Path vulnerability Exploitation: Clien...
eTicket 1.5.6-RC4 - index.php Cross-Site Scripting
eTicket 1.5.6-RC4 - index.php Cross-Site Scripting source: https://www.securityfocus.com/bid/27473/info eTicket is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code...
eticket156-xss.txt
eTicket 'index.php' Cross Site Scripting Path Vulnerability Name: eTicket 'index.php' Cross Site Scripting Path Vulnerability Application: eTicket Versions Affected: 1.5.6-RC4 Severity: Medium Vendor: eTicket, http://sourceforge.net/projects/eticket Bug: XSS Path vulnerability Exploitation: Clien...
eTicket 1.5.6-RC4 - 'index.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/27473/info eTicket is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...
Sql injection
Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 status, 2 sort, and 3 way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the 4 msg and 5 password...
CVE-2008-0266
Cross-site request forgery CSRF vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative password and possibly perform other administrative tasks. NOTE: either the old password must be known, or the attacker must leverage a separate SQL injection...
Cross site scripting
Cross-site scripting XSS vulnerability in view.php in eTicket 1.5.5.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter...
CVE-2008-0267
Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 status, 2 sort, and 3 way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the 4 msg and 5 password...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative password and possibly perform other administrative tasks. NOTE: either the old password must be known, or the attacker must leverage a separate SQL injection...
CVE-2008-0268
Cross-site scripting XSS vulnerability in view.php in eTicket 1.5.5.2 allows remote attackers to inject arbitrary web script or HTML via the s parameter...
CVE-2008-0267
CVE-2008-0267 describes multiple SQL injection vulnerabilities in eTicket 1.5.5.2. The flaws allow remote authenticated users to inject arbitrary SQL via search.php parameters (status, sort, way) and remote authenticated administrators to inject via admin.php parameters (msg, password). The root ...
CVE-2008-0267
Multiple SQL injection vulnerabilities in eTicket 1.5.5.2 allow remote authenticated users to execute arbitrary SQL commands via the 1 status, 2 sort, and 3 way parameters to search.php; and allow remote authenticated administrators to execute arbitrary SQL commands via the 4 msg and 5 password...
CVE-2008-0266
Cross-site request forgery CSRF vulnerability in admin.php in eTicket 1.5.5.2 allows remote attackers to change the administrative password and possibly perform other administrative tasks. NOTE: either the old password must be known, or the attacker must leverage a separate SQL injection...
CVE-2008-0266
The CVE-2008-0266 entry describes a CSRF vulnerability in the eTicket 1.5.5.2 product, specifically in the file admin.php, which allows remote attackers to change the administrative password and potentially perform other administrative tasks. The note states that either the attacker must know the...