209 matches found
FusionPHP Fusion News 3.3/3.6 X-ForwordedFor PHP Script Code Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13661/info FusionPHP Fusion News is prone to a remote PHP code injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. This may facilitate unauthorized access. ...
blur6ex <= 0.3.462 (ID) Admin Disclosure / Blind SQL Injection Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo blur6ex = 0.3.462 'ID' blind SQL injection / admin credentials disclosure\r\n; echo by rgod [email protected]\r\n; echo site: http://retrogod.altervista.org\r\n; echo dork: \powered by blur6ex\r\n\r\n; / works...
PHPcounter <= 1.3.2 (index.php name) Remote SQL Injection Exploit
No description provided by source. !/usr/bin/php -q ?php // PHPcounter = 1.3.2 Remote SQL Injection Exploit // Discovered By: StAkeR - StAkeRathotmaildotit // Discovered On: 28/09/2008 // Download: http://sourceforge.net/projects/phpcounter/ errorreporting0; $host = $argv1 or banner; $path = $arg...
WebAPP 0.9.9.2.1 - Remote Command Execution Exploit (2nd updated)
No description provided by source. ?php WebAPP v0.9.9.2.1 Remote Command Execution Exploit Code by Nikyt0x [email protected] Advisory: www.defacers.com.mx/advisories/3.txt Saludos: Soulblack Staff, Status-x, NeosecurityTeam, KingMetal, Trespasser... sbwebapp.php www.host.com /dirto/apage.cgi...
iPlanet 4.1 Web Publisher Remote Buffer Overflow Vulnerability (2)
No description provided by source. source: http://www.securityfocus.com/bid/2732/info iPlanet Webserver is an http server product offered by the Sun-Netscape Alliance. By sending a specially crafted request composed of at least 2000 characters it is possible to cause a buffer overflow. This could...
imacs CMS Unrestricted File Upload Exploit
Exploit for php platform in category web applications ?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit...
imacs CMS 0.3.0 Shell Upload
?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit Title : imacs CMS Unrestricted File Upload Exploit Date...
Bloofox CMS Unrestricted File Upload Exploit
Exploit for php platform in category web applications ?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit...
CVE-2012-5823
Open Source Classifieds does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP...
CVE-2012-5801
The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the...
Design/Logic Flaw
Open Source Classifieds does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP...
Code injection
The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the...
Code injection
The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to...
CVE-2012-5801
The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the...
CVE-2012-5788
The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP...
CVE-2012-5801
The CVE-2012-5801 entry concerns the PrestaShop PayPal module failing to verify the server hostname against the TLS certificate (CN/subjectAltName) during SSL handshakes via PHP fsockopen. This allows MITM spoofing with arbitrary valid certificates, impacting confidentiality and integrity (partia...
CVE-2012-5823
Open Source Classifieds does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP...
CVE-2012-5799
The Canada Post aka CanadaPost module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate,...
CVE-2012-5799
The CVE-2012-5799 issue affects the Canada Post module in PrestaShop, where the code path using PHP fsockopen does not verify that the server hostname matches a domain listed in the certificate’s Common Name (CN) or subjectAltName. This enables potential MITM spoofing of SSL servers using arbitra...
SugarCRM CE <= 6.3.1 "unserialize()" PHP代码执行漏洞
CVECAN ID: CVE-2012-0694 SugarCRM是开源的客户关系管理系统。 SugarCRM 6.4.0在"unserialize"的实现上存在安全漏洞，通过"SugarTheme"类的"destruct"方法的$REQUEST'currentquerybypage'输入变量传递临时序列化对象可导致执行任意PHP代码。 0 SugarCRM Community Edition = 6.3.1 厂商补丁： SugarCRM -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.sugarcrm.net/home/ ?p...