malbum03.txt

20/11/06 Produit Vulnérable : mAlbum v0.3 Site officiel du produit : http://satz.free.fr/ Vulnérabilitiezz : 1 Multiple Full path disclosure : http://localhost/malbum/index.php?gal=" 2Directory traversal :http://localhost/malbum/index.php?gal=../../../ Screen capturzz :...

phpmyadmin.txt

vendor site:http://phpmyadmin.net/ product:PhpMyAdmin all version bug: xss permanent & full path disclosure global risk:high xss post : 1 create a table , with whatever name , when it's done , go to "operation" /dboperations.php and add a comment on your table with: '"alertdocument.cookie the...

PhpMyAdmin all version [multiples vulnerability]

vendor site:http://phpmyadmin.net/ product:PhpMyAdmin all version bug: xss permanent & full path disclosure global risk:high xss post : 1 create a table , with whatever name , when it's done , go to "operation" /dboperations.php and add a comment on your table with:...

Mega Mall [ multiples injection sql & full path disclosure ]

vendor site: http://products.kaonsoftwares.com/ product: mega-mall bug:injection sql & full path disclosure language: asp risk: high injection sql get: http://site.com/mega-mall/productreview.php?t=sql http://site.com/mega-mall/productreview.php?t=0&productId=sql...

megamallSQL.txt

vendor site: http://products.kaonsoftwares.com/ product: mega-mall bug:injection sql & full path disclosure language: asp risk: high injection sql get: http://site.com/mega-mall/productreview.php?t=sql http://site.com/mega-mall/productreview.php?t=0&productId=sql...

mystats-108.txt

MyStats alertdocument.cookie&by=jour&ORDERER=datetime mystats/mystats.php?connexion="'/alertdocument.cookie&by=jour&ORDERER=datetime 2/3 Details Variable Injection Sql, Full Path Disclosure, Array GET & XSS Exploits: mystats/mystats.php?details=' mystats/mystats.php?details=...

wheatblogXSS.txt

vendor site: http://wheatblog.sourceforge.net/ product : Wheatblog bug: multiple xss post & full path disclosure risk : medium xss post : /addcomment.php vulnerable fieds : - Name - WWW - Comment impact: an attacker can steal the cookie from every persons who is watching at the comments. full pat...

[x0n3-h4ck]Drake CMS v 0.2 XSS exploit

-=--------------------ADVISORY-------------------=- Drake CMS V. 0.2 Author: CorryL x0n3-h4ck.org -=-----------------------------------------------=- -=+ Application: Drake CMS -=+ Version: 0.2 -=+ Vendor's URL: https://sourceforge.net/projects/drakecms/ -=+ Platform: WindowsLinuxUnix -=+ Bug typ...

CVE-2006-5844

Speedywiki 2.0 allows remote attackers to obtain the full path of the web server via the 1 showRevisions and 2 searchText parameters in a index.php, and b a direct request to upload.php without any parameters...

CVE-2006-5832

All In One Control Panel AIOCP 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to 1 public/code/cpdpage.php, possibly involving the aiocpdp parameter, 2 public/code/cpshowecproducts.php, possibly involving the orderfield parameter, and 3...

Wheatblog [multiple xss (post) & full path disclosure]

vendor site: http://wheatblog.sourceforge.net/ product : Wheatblog bug: multiple xss post & full path disclosure risk : medium xss post : /addcomment.php vulnerable fieds : - Name - WWW - Comment impact: an attacker can steal the cookie from every persons who is watching at the comments. full pat...

speedwiki20.txt

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

Speedwiki 2.0 Arbitrary File Upload Vulnerability

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

aiocp13007.txt

AIOCP '"alertdocument.cookie - /public/code/cpforumview.php?fmode=top&topid=53&forid='"alertdocument.cookie - /public/code/cpforumview.php?fmode=top&topid=53&forid=23&catid='"alertdocument.cookie - /public/code/cpdpage.php?choosedlanguage='"alertdocument.cookie -...

AIOCP 1.3.x - Multiple Vulnerabilities

AIOCP 1.3.x - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/20931/info All In One Control Panel AIOCP is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. Exploiting these issues could allow an attacker to...

AIOCP 1.3.x - cp_show_ec_products.php Full Path Disclosure

AIOCP 1.3.x - cpshowecproducts.php Full Path Disclosure source: https://www.securityfocus.com/bid/20931/info All In One Control Panel AIOCP is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. Exploiting these issues could allow...

AIOCP 1.3.x - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/20931/info All In One Control Panel AIOCP is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. Exploiting these issues could allow an attacker to steal cookie-based authentication...

IF-CMS.txt

vendor site: http://www.rhadrix.com/ risk : low xss = /index.php?rns=alertdocument.cookie full path array /index.php?rns= /index.php?pag= benjamin mossé & laurent gaffié http://s-a-p.ca/...

sphpblog多个输入验证漏洞

Simple PHP Blog是一款无需数据库支持的简单Blog程序。 sphpblog中存在多个漏洞，起因是应用程序没有正确的验证用户输入。远程攻击者可以利用这些漏洞获取敏感信息或执行任意代码。 A. 完整路径泄漏 http://Url/sphpblog/scripts/sbfunctions.php Ex: Warning: mainscripts/sbfileio.php: failed to open stream: No such file or directory in /var/www/sphpblog/scripts/sbfunctions.php on line 52...

phptopwebs-rfi.txt

===================================================================== PHP Top webs config.php Remote File Inclue Vulnerability ===================================================================== Author : Le CoPrA ===================================================================== Download...