40 matches found
MyBulletinBoard (MyBB) 1.2.10 - Multiple Vulnerabilities
waraxe-2008-SA061 - Remote Code Execution in MyBB 1.2.10 =============================================================================== Author: Janek Vind "waraxe" Independent discovery: koziolek Date: 16. January 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-61.html Target...
MyBulletinBoard (MyBB) 1.2.10 - Remote Code Execution
!/usr/bin/php -q -d shortopentag=on ?php // magicquotesgpc needs to be off errorreporting0; iniset"maxexecutiontime",0; iniset"defaultsockettimeout",5; if $argc5 print "-------------------------------------------------------------------------\r\n"; print " MyBB = 1.2.10 Remote Code Execution...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the 1 s parameter to index.php, and the 2 q parameter to a faq.php, b member.php, c memberlist.php, d calendar.php, e search.php, f forumdisplay.php, g...
CVE-2007-4453
Multiple cross-site scripting XSS vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the 1 s parameter to index.php, and the 2 q parameter to a faq.php, b member.php, c memberlist.php, d calendar.php, e search.php, f forumdisplay.php, g...
CVE-2005-1832
Multiple cross-site scripting XSS vulnerabilities in MyBulletinBoard MyBB 1.00 RC4 and earlier allow remote attackers to execute arbitrary web script or HTML via the 1 forums, 2 version, or 3 limit parameter to misc.php, 4 page or 5 datecut parameter to forumdisplay.php, 6 username, 7 email, or 8...
CVE-2005-1833
Multiple SQL injection vulnerabilities in MyBulletinBoard MyBB 1.00 RC4 allow remote attackers to execute arbitrary SQL commands via the 1 eid parameter to calendar.php, 2 idsql parameter to online.php, 3 usersearch parameter to memberlist.php, 4 pid parameter to editpost.php, 5 fid parameter to...
CVE-2004-1823
Multiple cross-site scripting XSS vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attackers to inject arbitrary web script or HTML via the 1 page parameter to showthread.php or 2 order parameter to forumdisplay.php...
CVE-2005-0429
CVE-2005-0429 affects vBulletin 3.0–3.0.4: Direct code injection in forumdisplay.php when showforumusers is enabled enables remote execution of arbitrary PHP commands via the comma parameter. Confirmed by NVD/OpenVAS/Nessus entries; impact is remote command execution with web server privileges. N...
vBulletin 3.0.4 - forumdisplay.php Code Execution (2)
vBulletin 3.0.4 - forumdisplay.php Code Execution 2 fetcharray$forumusers == True , when you visit the forums, it must has at least one user show the forum. Fourth condition: magicquotesgpc must be OFF Vulnerable Systems: vBulletin version 3.0 up to and including version 3.0.4 Immune systems:...
vbulletin 3.0.x PHP code execution
Vulnerable Systems: ---------------- vBulletin version 3.0 up to and including version 3.0.4 Immune systems: ---------------- vBulletin version 3.0.5 vBulletin version 3.0.6 Vulnerable code in forumdisplay.php : if $vboptions'showforumusers' . . . . if $bbuserinfo'userid' . . . . $comma = ', ';...
vBulletin <= 3.0.4 "forumdisplay.php" Code Execution (part 2)
Exploit for unknown platform in category web applications ============================================================= vBulletin fetcharray$forumusers == True , when you visit the forums, it must has at least one user show the forum. Fourth condition: magicquotesgpc must be OFF Vulnerable System...
[NOBYTES.COM: #2] CubeCart 2.0.4 - Multiple Vulnerabilities
Vulnerable Systems: ---------------- vBulletin version 3.0 up to and including version 3.0.4 Immune systems: ---------------- vBulletin version 3.0.5 vBulletin version 3.0.6 Vulnerable code in forumdisplay.php : if $vboptions'showforumusers' . . . . if $bbuserinfo'userid' . . . . $comma = ', ';...
vBulletin <= 3.0.4 "forumdisplay.php" Code Execution
Exploit for unknown platform in category web applications ==================================================== vBulletin fetcharray$forumusers == True , when you visit the forums, it must has at least one user show the forum. 4th condition : magicquotesgpc must be OFF SPECIAL condition : you must...
vBulletin 3.0.4 - forumdisplay.php Code Execution (1)
vBulletin 3.0.4 - forumdisplay.php Code Execution 1 Exploit: ---------------- http://site/forumdisplay.php?GLOBALS=1&f=2&comma=".system'id'." Conditions: ---------------- 1st condition : $vboptions'showforumusers' == True , the admin must set showforumusers ON in vbulletin options. 2nd condition ...
vBulletin forumdisplay.php comma Parameter Arbitrary Command Execution
The remote version of vBulletin is vulnerable to a remote command execution flaw through the script 'forumdisplay.php'. A malicious user could exploit this flaw to execute arbitrary commands on the remote host with the privileges of the web server. %NASLMINLEVEL 70300 C Tenable Network Security,...
vBulletin <= 3.0.4 ""forumdisplay.php"" Code Execution
No description provided by source. Exploit: ---------------- http://site/forumdisplay.php?GLOBALS=1&f=2&comma=".system'id'." Conditions: ---------------- 1st condition : $vboptions'showforumusers' == True , the admin must set showforumusers ON in vbulletin options. 2nd condition :...
CVE-2004-0323
Multiple SQL injection vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to inject arbitrary SQL and gain privileges via the 1 ppp parameter in viewthread.php, 2 desc parameter in misc.php, 3 tpp parameter in forumdisplay.php, 4 ascdesc parameter in forumdisplay.php, or 5 the addon...
JelSoft vBulletin Multiple XSS Vulnerabilities
Vendor : Jelsoft Enterprises URL : http://www.vbulletin.com Version : vBulletin 3.0.0 RC4 && Others Risk : Cross Site Scripting Description: vBulletin is a powerful, scalable and fully customisable forums package for your web site. Based on the PHP language, backed with a blisteringly fast MySQL...
vBulletin 3.0 - forumdisplay.php Cross-Site Scripting
vBulletin 3.0 - forumdisplay.php Cross-Site Scripting source: https://www.securityfocus.com/bid/9888/info It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'forumdisplay.php' script. This issue is reportedly due to a failure to sanitize user input and so...
vBulletin 3.0 - 'forumdisplay.php' Cross-Site Scripting
source: https://www.securityfocus.com/bid/9888/info It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'forumdisplay.php' script. This issue is reportedly due to a failure to sanitize user input and so allow for injection of HTML and script code that may...