Improper access control

Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3...

Sql injection

SQL injection vulnerability in havapost.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in havaupload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/...

CVE-2012-5893

Unrestricted file upload vulnerability in havaupload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/...

CVE-2012-5892

Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3...

CVE-2012-5893

The CVE-2012-5893 entry concerns Havalite CMS (versions up to 1.1.0). A vulnerability in hava_upload.php allows unrestricted file upload, where an attacker can upload a file with a .php;.gif extension and then access it directly under tmp/files/ to execute arbitrary code on the server. This const...

CVE-2012-5892

The CVE-2012-5892 entry pertains to Havalite CMS 1.1.0 and earlier, where improper access control allows remote attackers to download the configuration database (data/havalite.db3) from the web root. The root cause is insecure storage of sensitive data under the web root, enabling direct requests...

CVE-2012-5894

Summary: CVE-2012-5894 describes a SQL injection in Havalite CMS up to version 1.1.0, via the postId parameter in hava_post.php, enabling remote arbitrary SQL execution. The connected documents consistently identify the affected software as Havalite CMS 1.1.0 and earlier and attribute the issue t...

CVE-2012-5894

SQL injection vulnerability in havapost.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter...

Havalite CMS v1.0.4 - Multiple Web Vulnerabilities

Title: ====== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities Date: ===== 2012-04-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=520 VL-ID: ===== 520 Introduction: ============= Havalite, a lightweight, open source CMS, based on php and SQLite. It's licensed unde...

Havalite CMS 1.0.4 - Multiple Vulnerabilities

Havalite CMS 1.0.4 - Multiple Vulnerabilities Title: ====== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities Date: ===== 2012-04-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=520 VL-ID: ===== 520 Introduction: ============= Havalite, a lightweight, open source CM...

Havalite CMS v1.0.4 Multiple Vulnerabilities

Exploit for php platform in category web applications Title: ====== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities Date: ===== 2012-04-23 Introduction: ============= Havalite, a lightweight, open source CMS, based on php and SQLite. It\\\'s licensed under the GNU General Public License. - A...

Havalite CMS 1.0.4 Cross Site Scripting

Title: ====== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities Date: ===== 2012-04-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=520 VL-ID: ===== 520 Introduction: ============= Havalite, a lightweight, open source CMS, based on php and SQLite. It\\\'s licensed...

Havalite CMS 1.0.4 - Multiple Vulnerabilities

Title: ====== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities Date: ===== 2012-04-23 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=520 VL-ID: ===== 520 Introduction: ============= Havalite, a lightweight, open source CMS, based on php and SQLite. It\\\'s licensed...

Havalite CMS v1.0.4 - Multiple Web Vulnerabilities

Document Title: =============== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=520 Release Date: ============= 2012-04-22 Vulnerability Laboratory ID VL-ID: ==================================== 520...

Havalite CMS v1.0.4 - Multiple Web Vulnerabilities

Document Title: =============== Havalite CMS v1.0.4 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=520 Release Date: ============= 2012-04-22 Vulnerability Laboratory ID VL-ID: ==================================== 520...

Havalite CMS Shell Upload / SQL Injection / Disclosure

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail :...

Havalite CMS latest (FU/SQLi/dCDB) Mutiple Vulnerabilities

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

havalite 1.0 <= CSRF Add Admin user

Exploit for php platform in category web applications » havalite 1.0 » --- Date : 29- 03- 2012 » --- Author : Expl0!Ts » --- Software Link : http://havalite.com/downloads/havalite.zip » --- Version: 1.0 » --- Category: php » --- Tested on: wind xp & ubuntu 10.10 » --- Dork : your mind 1- First Vu...