Design/Logic Flaw

hits.php in myWebland myStats allows remote attackers to bypass IP address restrictions via a modified X-Forwarded-For HTTP header...

CVE-2008-4644

CVE-2008-4644 affects hits.php in the myWebland myStats component, where remote attackers can bypass IP address restrictions by tampering with the X-Forwarded-For HTTP header. The vulnerability is triggered by trusting a manipulated X-Forwarded-For value, allowing bypass of access controls intend...

mystats-multi.txt

myStats hits.php Multiple Remote Vulnerabilities Exploit url: http://mywebland.com/ Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. Use it at your own risk. Author will be not responsible for...

mystats - hits.php Multiple Vulnerabilities

mystats - hits.php Multiple Vulnerabilities myStats hits.php Multiple Remote Vulnerabilities Exploit url: http://mywebland.com/ Author: JosS mail: sys-projectathotmaildotcom site: http://spanish-hackers.com team: Spanish Hackers Team - SHT This was written for educational purpose. Use it at your...

Nuked-klaN 1.7.7 SP4.4 - Multiple Vulnerabilities

Nuked-klaN 1.7.7 SP4.4 - Multiple Vulnerabilities URL: http://real.o-n.fr/ Date: 14/10/2008 Special thanks to Louis for remembering me I had to finish it = VULNERABILITY DETAILS --------------------- Nuked-klaN suffers from a vulnerability due to HTTPREFERER, which is not correctly filtered befor...

Nuked-klaN 1.7.7 / SP4.4 - Multiple Vulnerabilities

URL: http://real.o-n.fr/ Date: 14/10/2008 Special thanks to Louis for remembering me I had to finish it = VULNERABILITY DETAILS --------------------- Nuked-klaN suffers from a vulnerability due to HTTPREFERER, which is not correctly filtered before being inserted in nukedstatsvisitor table. If HT...

Sql injection

SQL injection vulnerability in Triton CMS Pro allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...

CVE-2008-3153

SQL injection vulnerability in Triton CMS Pro allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...

CVE-2008-3153

CVE-2008-3153 affects Triton CMS Pro, with a SQL injection vulnerability exploitable via the X-Forwarded-For HTTP header. The available documents identify the vulnerability class and entry but do not specify affected versions, root cause details beyond “SQL injection,” or concrete remediation ste...

Triton CMS Pro (X-Forwarded-For) Blind SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w Triton CMS Pro X-Forwarded-For Blind SQL Injection Admin's username/hash disclosure exploit Benchmark method, so take a coffee and relax Coded by GiReX use LWP::UserAgent; use HTTP::Request; ifnot defined $ARGV0 print "\nUsage: perl $0 host pat...

Triton CMS Pro 1.06 - x-forwarded-for Blind SQL Injection

Triton CMS Pro 1.06 - x-forwarded-for Blind SQL Injection !/usr/bin/perl -w Triton CMS Pro X-Forwarded-For Blind SQL Injection Admin's username/hash disclosure exploit Benchmark method, so take a coffee and relax Coded by GiReX use LWP::UserAgent; use HTTP::Request; ifnot defined $ARGV0 print...

Triton CMS Pro (X-Forwarded-For) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================ Triton CMS Pro X-Forwarded-For Blind SQL Injection Exploit ============================================================ !/usr/bin/perl -w Triton CMS Pro X-Forwarded-For Blind SQL...

PHP168 X-Forwarded-For exploit-vulnerability warning-the black bar safety net

amxku's blog http://www.amxku.net/ author: amxku The vulnerability itself is the cause of nothing to say, old X-Forwarded-For problem, I think this loophole a lot of people have found it. Because of this vulnerability for some time, and was just on the pc to test it, may be some error, interested...

CVE-2008-1483

OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 IPv4 and sniffing a cookie sent by Emacs...

CVE-2008-1398

CVE-2008-1398 describes an SQL injection in AuraCMS 2.0–2.2.1 via the X-Forwarded-For HTTP header (HTTP_X_FORWARDED_FOR environment variable) that allows remote execution of arbitrary SQL commands. Affected component is online.php; root cause is improper handling/validation of the header value in...

AuraCMS 2.2.1 - X-Forwarded-For HTTP Header Blind SQL Injection

AuraCMS 2.2.1 - X-Forwarded-For HTTP Header Blind SQL Injection !/usr/bin/perl -w Indonesian Newhack Security Advisory ------------------------------------ AuraCMS 2.x online.php - Remote Blind SQL Injection Exploit Waktu : Feb 15 2008 01:00PM Software : AuraCMS Versi : 2.0 2.1 2.2.1 Vendor :...

AuraCMS <= 2.2.1 (online.php) Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================ AuraCMS 0 15. @mysqlquery"update useronline set timevisit='$utime' where ipproxy='$uipproxy'"; 16. else 17. @mysqlquery"insert into useronline...

Code injection

stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php...

CVE-2008-0390

stat.php in AuraCMS 1.62, and Mod Block Statistik for AuraCMS, allows remote attackers to inject arbitrary PHP code into online.db.txt via the X-Forwarded-For HTTP header in a stat action to index.php, and execute online.db.txt via a certain request to index.php...

CVE-2008-0390

CVE-2008-0390 affects AuraCMS 1.62 and Mod Block Statistik for AuraCMS. The vulnerability is a remote code-injection via the X-Forwarded-For header in a stat action to index.php, allowing an attacker to inject arbitrary PHP code into online.db.txt and later execute online.db.txt through a crafted...