3365 matches found
Sql injection
SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...
CVE-2007-6083
SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...
CVE-2007-6083
SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...
CVE-2007-6083
IceBB 1.0-rc6 contains a SQL injection in admin/index.php exploitable via the X-Forwarded-For HTTP header. Remote attackers can execute arbitrary SQL commands. The connected documents confirm the affected software and vulnerability class, but do not provide remediation steps or patched versions. ...
CVE-2007-6083: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in admin/index.php in IceBB 1.0-rc6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header...
IceBB HTTP_X_FORWARDED_FOR变量远程SQL注入漏洞
BUGTRAQ ID: 26483 IceBB是一个基于PHP+MySQL的开源论坛系统。 IceBB处理畸形用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击，非授权操作数据库。 IceBB的index.php脚本没有正确地验证对X-Forwarded-For HTTP头的输入。在/includes/functions.php文件的73行： $ip = empty$SERVER'HTTPXFORWARDEDFOR' ? $SERVER'REMOTEADDR' : $SERVER'HTTPXFORWARDEDFOR'; $ip = $this-cleankey$ip;...
IceBB 1.0rc6 <= Remote SQL Injection
|Description:| A security breach has been discoverd in IceBB 1.0-rc6. This breach is caused by a bad filtering of the X-Forwarded-For variable: ./includes/functions.php, line 73 $ip = empty$SERVER'HTTPXFORWARDEDFOR' ? $SERVER'REMOTEADDR' : $SERVER'HTTPXFORWARDEDFOR'; $ip = $this-cleankey$ip;...
IceBB 1.0-rc6 Remote Database Authentication Details Exploit
Exploit for unknown platform in category web applications ============================================================ IceBB 1.0-rc6 Remote Database Authentication Details Exploit ============================================================ ./includes/functions.php, line 73 $ip =...
IceBB 1.0-rc6 - Remote Database Authentication Details
./includes/functions.php, line 73 $ip = empty$SERVER'HTTPXFORWARDEDFOR' ? $SERVER'REMOTEADDR' : $SERVER'HTTPXFORWARDEDFOR'; $ip = $this-cleankey$ip; $input'ICEBBUSERIP' = $ip; ./icebb.php, line 169 $icebb-clientip = $input'ICEBBUSERIP'; ./admin/index.php, line 112 $icebb-adsess =...
IceBB 1.0-rc6 - Remote Database Authentication Details
IceBB 1.0-rc6 - Remote Database Authentication Details ./includes/functions.php, line 73 $ip = empty$SERVER'HTTPXFORWARDEDFOR' ? $SERVER'REMOTEADDR' : $SERVER'HTTPXFORWARDEDFOR'; $ip = $this-cleankey$ip; $input'ICEBBUSERIP' = $ip; ./icebb.php, line 169 $icebb-clientip = $input'ICEBBUSERIP';...
CVE-2002-2231
Cross-site scripting XSS vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via 1 a javascript: URL in a photo URL or 2 an X-Forwarded-For: header...
CVE-2002-2231: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via 1 a javascript: URL in a photo URL or 2 an X-Forwarded-For: header...
Sql injection
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For XFORWARDEDFOR HTTP header, as demonstrated by a request to the /nk/ URI...
CVE-2007-2556
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For XFORWARDEDFOR HTTP header, as demonstrated by a request to the /nk/ URI...
CVE-2007-2556
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For XFORWARDEDFOR HTTP header, as demonstrated by a request to the /nk/ URI...
CVE-2007-2556
Nuked-klaN is affected by CVE-2007-2556 via SQL injection in the web layer. Reported vulnerability allows remote attackers to inject SQL commands through HTTP headers (X-Forwarded-For) and relates to the /nk/ URI; DSquare cites 1.7.7 / SP4.4 as vulnerable and notes a Referer-header vector. The NV...
Sql injection
Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a 1 nickname or 2 Id in a cookie, or 3 the X-Forwarded-For XFORWARDEDFOR HTTP header...
CVE-2007-2537
Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a 1 nickname or 2 Id in a cookie, or 3 the X-Forwarded-For XFORWARDEDFOR HTTP header...
CVE-2007-2537: Undefined Security Weakness
Multiple SQL injection vulnerabilities in mainfile.php in NPDS 5.10 and earlier allow remote authenticated users to execute arbitrary SQL commands via a 1 nickname or 2 Id in a cookie, or 3 the X-Forwarded-For XFORWARDEDFOR HTTP header...
CVE-2007-2556: Undefined Security Weakness
SQL injection vulnerability in Nuked-klaN 1.7.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For XFORWARDEDFOR HTTP header, as demonstrated by a request to the /nk/ URI...