CVE-2006-3564

Multiple cross-site scripting XSS vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the email, 2 cond, or 3 name parameters to a addressbook.view.php, 4 the daysprune parameter to b index.php, 5 the datato parameter to c...

CVE-2006-3565

SQL injection vulnerability in search.results.php in HiveMail 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the fields parameter...

CVE-2006-3565

The CVE-2006-3565 entry describes an SQL injection in HiveMail (version 1.3 and earlier) that affects search.results.php via the fields[] parameter, allowing a remote attacker to execute arbitrary SQL commands. The vulnerability is categorized with a high base score (7.5, CVSSv2: AV:N/AC:L/Au:N/C...

CVE-2006-3566

search.results.php in HiveMail 3.1 and earlier allows remote attackers to obtain the installation path via certain manipulations related to the 1 searchdate and 2 folderids parameters...

[SA20993] HiveMail Cross-Site Scripting and SQL Injection Vulnerabilities

---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation...

HiveMail 1.3 - addressbook.add.php Remote Code Execution

HiveMail 1.3 - addressbook.add.php Remote Code Execution !/usr/bin/perl HiveMail = 1.3 remote command execution exploit Advisory: http://www.gulftech.org/?node=research&articleid=00098-02102006 To get the hivesession: log on hivemail with firefox then look at the hivesession number in the url. ye...

HiveMail <= 1.3 (addressbook.add.php) Remote Code Execution Exploit

Exploit for unknown platform in category web applications =================================================================== HiveMail = 1.3 addressbook.add.php Remote Code Execution Exploit =================================================================== !/usr/bin/perl HiveMail = 1.3 remote...

HiveMail 1.3 - 'addressbook.add.php' Remote Code Execution

!/usr/bin/perl HiveMail = 1.3 remote command execution exploit Advisory: http://www.gulftech.org/?node=research&articleid=00098-02102006 To get the hivesession: log on hivemail with firefox then look at the hivesession number in the url. yes i know... Dork: "Already have an account?" "Enter your...

Sql injection

Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

CVE-2006-0759

Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

CVE-2006-0757

Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

Sql injection

Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

CVE-2006-0758

Multiple cross-site scripting XSS vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in 1 index.php and 2 possibly certain other scripts, which is not properly cleansed when accessed from the...

CVE-2006-0757

Multiple eval injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary PHP code via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

CVE-2006-0759

Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via 1 the contactgroupid parameter in addressbook.update.php, 2 the messageid parameter in addressbook.add.php, 3 the folderid parameter in folders.update.php, and possibly...

CVE-2006-0757

CVE-2006-0757 describes multiple PHP eval-injection vulnerabilities in HiveMail 1.3 and earlier, allowing remote attackers to execute arbitrary PHP code via various parameters (e.g., contactgroupid in addressbook.update.php, messageid in addressbook.add.php, folderid in folders.update.php, and ot...

CVE-2006-0758

Multiple cross-site scripting XSS vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via a URL encoded expression in the query string in 1 index.php and 2 possibly certain other scripts, which is not properly cleansed when accessed from the...

CVE-2006-0759

CVE-2006-0759 involves multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier. The issues arise from improper handling of $_SERVER['PHP_SELF'], enabling attackers to inject SQL commands through numerous parameters across scripts (e.g., contactgroupid in addressbook.update.php, message...

CVE-2006-0758

CVE-2006-0758 involves multiple XSS vulnerabilities in HiveMail 1.3 and earlier. The issue arises from URL encoded expressions in the query string (in index.php and potentially other scripts) not being properly cleansed when accessed via $_SERVER['PHP_SELF'], allowing remote attackers to inject a...

HiveMail-1.3.txt

GulfTech Security Research February 10, 2006 Vendor : HiveMail URL : http://www.hivemail.com/ Version : HiveMail queryfirst" SELECT contacts FROM hivecontactgroup WHERE contactgroupid = $contactgroupid AND userid = $hiveuseruserid ";...