130 matches found
CVE-2009-4460: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Auto-Surf Traffic Exchange Script 1.1 allow remote attackers to inject arbitrary web script or HTML via the rid parameter to 1 index.php, 2 faq.php, and 3 register.php...
CyberCMS - faq.php SQL Injection
CyberCMS - faq.php SQL Injection source: https://www.securityfocus.com/bid/39698/info Cyber CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...
CVE-2008-2460
SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action...
CVE-2008-2460
CVE-2008-2460 is an SQL injection vulnerability affecting vBulletin 3.7.0 Gold . The flaw is in faq.php where the q parameter in a search action is vulnerable, enabling remote attackers to execute arbitrary SQL commands . NVD lists a CVSS v2 base score of 7.5 (HIGH) with network access, no authen...
CVE-2008-2460: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action...
Vbulletin 3.7.0 Gold >> Sql injection on faq.php
By : Ali JasbiHackerz.ir security & hacking research team Vendor : vbulletin.org version : 3.7.0 Gold Vulnerability: Sql injection http://www.domain.com/vBulletin/faq.php?s=&do=search&q=Sql injection&match=any&titlesonly=1 test it: faq.php?s=&do=search&q='&match=any&titlesonly=1...
CVE-2007-6667
SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413...
CVE-2007-6667
The CVE-2007-6667 entry describes an SQL injection in MyPHP Forum 3.0 and earlier, exploitable via the id parameter in faq.php. The vulnerability allows remote execution of arbitrary SQL commands, with the attack surface limited to the FAQ handling path; the note indicates the member.php vector i...
Sql injection
Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the categoryid parameter to faq.php, and unspecified other vectors involving additional scripts...
CVE-2007-6633: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via 1 the catname parameter to faq.php; and unspecified parameters to the 2 add categories, 3 edit categories, 4 delete categories, 5 add faq...
CVE-2007-6633
CVE-2007-6633 involves multiple cross-site scripting (XSS) vulnerabilities in FAQMasterFlexPlus (potentially versions 1.5 or 1.52). The issues allow remote attackers to inject arbitrary web script or HTML via the cat_name parameter to faq.php and via parameters to admin actions (add/edit/delete c...
CVE-2007-6633
Multiple cross-site scripting XSS vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to inject arbitrary web script or HTML via 1 the catname parameter to faq.php; and unspecified parameters to the 2 add categories, 3 edit categories, 4 delete categories, 5 add faq...
CVE-2007-6634: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in FAQMasterFlexPlus, possibly 1.5 or 1.52, allow remote attackers to execute arbitrary SQL commands via the categoryid parameter to faq.php, and unspecified other vectors involving additional scripts...
CVE-2007-6667: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413...
NetBizCity FaqMasterFlexPlus 'faq.php' SQL注入漏洞
BUGTRAQ ID: 27052 CNCAN ID:CNCAN-2008010202 NetBizCity FaqMasterFlexPlus是一款基于PHP的WEB应用程序。 NetBizCity FaqMasterFlexPlus不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'faq.php'脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 NetBizCity FaqMasterFlexPlus --------- 目前没有解决方案提供...
MyPHP Forum 'faq.php' and 'member.php' Multiple SQL Injection Vulnerabilities
MyPHP Forum is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in t...
myphp-sql.txt
Name : MyPHP Forum So we can execute an sql injection thrught the bugged variable $id. PoC: http://Site/faq.php?action=view&id=-1'+union+select+1,concatusername,0x3a,password,3+from+tableprefixmember+where+uid=1/ Sql injection in member.php So $member variable isn't controlled so we can exploit i...
MyPHP Forum 3.0 (Final) - Multiple SQL Injections
Name : MyPHP Forum So we can execute an sql injection thrught the bugged variable $id. PoC: http://Site/faq.php?action=view&id=-1'+union+select+1,concatusername,0x3a,password,3+from+tableprefixmember+where+uid=1/ Sql injection in member.php So $member variable isn't controlled so we can exploit i...
NetBizCity FaqMasterFlexPlus - faq.php Cross-Site Scripting
NetBizCity FaqMasterFlexPlus - faq.php Cross-Site Scripting source: https://www.securityfocus.com/bid/27051/info FaqMasterFlexPlus is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFLFILEROOT parameter to 1 admin.php, 2 custompages.php, 3 draft.php, 4 faq.php, 5 leagues.php, 6 livedraft.php, 7 login.php, 8 myteam.php, 9 profile.php, 10...