Planet 1.1 - Cross-Site Request Forgery (Add Admin)

Planet 1.1 - Cross-Site Request Forgery Add Admin Exploit Title: Planet 1.1 - CSRF Add Admin Account Date: 17-06-2010 Author: G0D-F4Th3r Software Link: http://php.femtolayer.com/planet11/ Version: 1.1 Tested on: http://php.femtolayer.com/planet11/ /cp/security.php?do=admins" Greetz to : AL-MoGrM ...

Acc PHP eMail 1.1 - Cross-Site Request Forgery

Acc PHP eMail 1.1 - Cross-Site Request Forgery /\ == \ /\ \ /\ \ \ \ // End of attack ------------------------------------------------------------------------------------------ EOF...

CVE-2006-3398

The "change password forms" in Taskjitsu before 2.0.1 includes password hashes in hidden form fields, which allows remote attackers to obtain sensitive information from the 1 Category Editor and 2 User Information editor...

CVE-2005-2428

Lotus Domino R5/R6 WebMail with Generate HTML for all fields enabled can reveal sensitive data via names.nsf hidden fields. The connected nuclei template documents information disclosure: password hashes in HTTPPassword, password-change date in HTTPPasswordChangeDate, and client release in ClntBl...

CVE-2004-2058

CVE-2004-2058 affects ASPrunner 2.4, where a remote attacker can disclose sensitive information via (1) hidden form fields or (2) error messages. The core description in the CVE entry is that ASPRunner 2.4 allows information disclosure to unauthenticated remote actors. Connected documents corrobo...

CVE-2004-2058

ASPRunner 2.4 allows remote attackers to gain sensitive information via 1 hidden form fields or 2 error messages...

CVE-2004-2058

ASPRunner 2.4 allows remote attackers to gain sensitive information via 1 hidden form fields or 2 error messages...

PHP 3.0.x < 3.0.17 / 4.0.x < 4.0.3 Hidden Form Field File Upload

Binary data 1478.prm...

CVE-2003-1212

MaxWebPortal 1.30 allows remote attackers to perform unauthorized actions by modifying hidden form fields, such as the 1 news, 2 lock, or 3 allmem fields in the 'start new topic' HTML page...

Maxwebportal 1.30 - search.asp?Search Cross-Site Scripting

Maxwebportal 1.30 - search.asp?Search Cross-Site Scripting source: https://www.securityfocus.com/bid/7837/info A number of vulnerabilities have been discovered in the MaxWebPortal. The issues that have been discovered include: MaxWebPortal 'search.asp' has been reported prone to a cross-site...

Max Web Portal 1.30 - Multiple Vulnerabilities

Max Web Portal 1.30 - Multiple Vulnerabilities Max Web Portal Multiple Vulnerabilities Vendor: Max Web Portal Product: Max Web Portal Version: alertdocument.cookie Remember this vuln as I will later explain how it can be used to aide an attacker to compromise user and admin accounts. Hidden Form...

Max Web Portal < 1.30 - Multiple Vulnerabilities

Max Web Portal Multiple Vulnerabilities Vendor: Max Web Portal Product: Max Web Portal Version: alertdocument.cookie Remember this vuln as I will later explain how it can be used to aide an attacker to compromise user and admin accounts. Hidden Form Field weakness: The Max Web Portal system seems...

Maxwebportal 1.30 - Remote Database Disclosure

source: https://www.securityfocus.com/bid/7837/info A number of vulnerabilities have been discovered in the MaxWebPortal. The issues that have been discovered include: MaxWebPortal 'search.asp' has been reported prone to a cross-site scripting vulnerability. An attacker may execute arbitrary scri...

CVE-2002-1462

details2.php in OrganicPHP PHP-affiliate 1.0, and possibly later versions, allows remote attackers to modify information of other users by modifying certain hidden form fields...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (2)

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure 2 source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (1)

source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software. !/usr/bin/perl use LWP::UserAgent; use HTTP::Request; use...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (1)

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure 1 source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software...

Typo3 3.5 b5 - HTML Hidden Form Field Information Disclosure (2)

source: https://www.securityfocus.com/bid/6993/info Clients of TYPO3 systems may access potentially sensitive data that have been obfuscated through hidden form fields. This may aid in exploiting other known issues in the software. !/usr/bin/perl use strict; use Getopt::Std; use LWP::UserAgent; u...

CVE-2002-2302

3D3.Com ShopFactory 5.5 through 5.8 allows remote attackers to modify the prices in their shopping carts by modifying the price in a hidden form field...

wp-02-0012: Carello 1.3 Remote File Execution

Westpoint Security Advisory Title: Carello 1.3 Remote File Execution Risk Rating: Medium Software: Carello Shopping Cart Platforms: Win2k, WinNT Vendor URL: www.carelloweb.com Author: Matt Moore [email protected] Date: 10th July 2002 Advisory ID: wp-02-0012 Overview: ========= Carello 1.3 is ...