glFusion 1.1.x/1.2.1 - 'users.php' SQL Injection

source: https://www.securityfocus.com/bid/46575/info glFusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data...

glFusion CMS Blind SQL Injection

= == === ====== == == == ==== === ==== ==== ==== === ==== === ==== glFusion CMS Blind SQL injection Vulnerability = == === ====== == == == ==== === ==== ==== ==== === ==== === ==== Author:H3X Cradit:Sepehr Security Team Reference: Product:glFusion CMS google Dork:"Powered by glFusion CMS"...

glFusion CMS 1.2.1 Stored XSS via img Tag

Exploit for php platform in category web applications Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easily...

glfusion CMS 1.2.1 - img Persistent Cross-Site Scripting

glfusion CMS 1.2.1 - img Persistent Cross-Site Scripting Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easi...

glfusion CMS 1.2.1 - 'img' Persistent Cross-Site Scripting

Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easily create websites and online communities complete with...

glfusion CMS 1.2.1 Cross Site Scripting

Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag Date: 14-1-2010 Author: Saif El-Sherei Software Link: www.glfusion.org/filemgmt/viewcat.php?cid=1 Version: 1.2.1 Tested on: Firefox 3.0.15 Info: glFusion gives you the ability to easily create websites and online communities complete with...

glFusion Multiple SQL Injection Vulnerabilities

glFusion is prone to multiple SQL injection vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-4796

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 order and 2 direction parameters to search.php...

CVE-2009-4796

Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 order and 2 direction parameters to search.php...

CVE-2009-4796

glFusion versions 1.1.2 and earlier are affected by multiple SQL injection vulnerabilities in the ExecuteQueries function of private/system/classes/listfactory.class.php. The flaw allows remote attackers to inject arbitrary SQL via the (1) order and (2) direction parameters to search.php. Impact ...

glFusion lib-session.php模块SQL注入漏洞

BUGTRAQ ID: 34361 CVECAN ID: CVE-2009-1282,CVE-2009-1283 glFusion是一个开源的内容管理系统。 glFusion的private/system/lib-session.php模块没有正确地过滤用户所提交的glfsession cookie参数，远程攻击者可以通过向服务器提交恶意请求执行SQL注入攻击。以下是/private/system/lib-session.php 的97-117行的有漏洞代码段： ... if isset $COOKIE$CONF'cookiesession' $sessid = COMapplyFilt...

Geeklog <=1.5.2 'SESS_updateSessionTime()' vulnerability

As the vendor stated, see: http://www.geeklog.net/article.php/geeklog-1.5.2sr2 geeklog is also vulnerable to this: http://www.securityfocus.com/bid/34361/info actually this should be renamed in glFusion 'SESSupdateSessionTime' SQL Injection Vulnerability...

CVE-2009-1281

Cross-site scripting XSS vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-1282

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glfsession cookie parameter...

CVE-2009-1283

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glfpassword cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection...

Cross site scripting

Cross-site scripting XSS vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Sql injection

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glfpassword cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection...

Sql injection

SQL injection vulnerability in private/system/lib-session.php in glFusion 1.1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the glfsession cookie parameter...

CVE-2009-1281

Cross-site scripting XSS vulnerability in glFusion before 1.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-1283

glFusion before 1.1.3 performs authentication with a user-provided password hash instead of a password, which allows remote attackers to gain privileges by obtaining the hash and using it in the glfpassword cookie, aka "User Masquerading." NOTE: this can be leveraged with a separate SQL injection...