glFusion 1.1.x1.2.1 - users.php SQL Injection

glFusion 1.1.x1.2.1 - users.php SQL Injection source: https://www.securityfocus.com/bid/46575/info glFusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

glFusion 1.1.x/1.2.1 - 'users.php' SQL Injection

source: https://www.securityfocus.com/bid/46575/info glFusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data...

glFusion CMS 1.2.1 Stored XSS via img Tag

Exploit for php platform in category web applications Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easily...

glfusion CMS 1.2.1 - img Persistent Cross-Site Scripting

glfusion CMS 1.2.1 - img Persistent Cross-Site Scripting Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easi...

glfusion CMS 1.2.1 - 'img' Persistent Cross-Site Scripting

Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easily create websites and online communities complete with...

glfusion CMS 1.2.1 Cross Site Scripting

Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easily create websites and online communities complete with...

glFusion Multiple SQL Injection Vulnerabilities

glFusion is prone to multiple SQL injection vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-4796

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 order and 2 direction parameters to search.php...

CVE-2009-4796

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 order and 2 direction parameters to search.php...

CVE-2009-4796

glFusion versions 1.1.2 and earlier are affected by multiple SQL injection vulnerabilities in the ExecuteQueries function of private/system/classes/listfactory.class.php. The flaw allows remote attackers to inject arbitrary SQL via the (1) order and (2) direction parameters to search.php. Impact ...

glFusion lib-session.php模块SQL注入漏洞

BUGTRAQ ID: 34361 CVECAN ID: CVE-2009-1282,CVE-2009-1283 glFusion是一个开源的内容管理系统。 glFusion的private/system/lib-session.php模块没有正确地过滤用户所提交的glfsession cookie参数，远程攻击者可以通过向服务器提交恶意请求执行SQL注入攻击。以下是/private/system/lib-session.php 的97-117行的有漏洞代码段： ... if isset $COOKIE$CONF'cookiesession' $sessid = COMapplyFilt...

Geeklog <=1.5.2 'SESS_updateSessionTime()' vulnerability

As the vendor stated, see: http://www.geeklog.net/article.php/geeklog-1.5.2sr2 geeklog is also vulnerable to this: http://www.securityfocus.com/bid/34361/info actually this should be renamed in glFusion 'SESSupdateSessionTime' SQL Injection Vulnerability...

CVE-2009-1282

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glfsession cookie parameter...

CVE-2009-1281

Cross-site scripting XSS vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-1283

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glfpassword cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection...

Cross site scripting

Cross-site scripting XSS vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Sql injection

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glfsession cookie parameter...

Sql injection

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glfpassword cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection...

CVE-2009-1283

CVE-2009-1283 affects glFusion before 1.1.3. Authentication can be bypassed by using a user-provided password hash in the glf_password cookie, enabling remote privilege gain (User Masquerading). Reports also describe a separate SQL injection in lib-session.php that can steal hashes via the sessio...

CVE-2009-1281

CVE-2009-1281 describes a cross-site scripting (XSS) vulnerability in glFusion before 1.1.3. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. According to NVD metrics, the attack has a Network vector, no authentication, and does not affect confiden...