Uiga Personal Portal - Multiple Vulnerabilities

Uiga Personal Portal - Multiple Vulnerabilities Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the command...

fims File Management System 1.2.1a - Multiple Vulnerabilities

fims File Management System 1.2.1a - Multiple Vulnerabilities Exploit Title: fims - File Management System execute"select from fimsuser where email='$email' and password=md5'$password'"; if $db-numrows$rs0 return true; else return false; Line 51 of index.php: if isset$REQUESTf...

Uiga Personal Portal Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Uiga Personal Portal Multiple Vulnerability Date: 2011 Author: Eyup CELIK Version: All Version Tested on: All versions are Vulnerability Web Site: www.eyupcelik.com.tr ISSUE Blind SQL Injection and XSS can be done using the...

Yet Another CMS 1.0 - SQL Injection / Cross-Site Scripting

Advisory: Yet Another CMS 1.0 SQL Injection & XSS vulnerabilities Advisory ID: SSCHADV2011-031 Author: Stefan Schurtz Affected Software: Successfully tested on Yet Another CMS 1.0 Vendor URL: http://yetanothercms.codeplex.com/ Vendor Status: informed ========================== Vulnerability...

Site@School 2.4.10 - index.php Cross-Site Scripting SQL Injection

Site@School 2.4.10 - index.php Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/50195/info Site@School is prone to multiple SQL-injection and cross-site scripting vulnerabilities. Exploiting these issues could allow an attacker to steal cookie-based authentication...

iSchoolSite SQL Injection

========================================================================== Exploit Title: iSchoolSite SQL Injection Vulnerability Date: 16.10.2011 Author: poach3r Software Link: http://www.ischoolsite.com/ Tested on: Windows XP SP3 Google Dork: "Powered by iSchoolSite" inurl:.php Price: $5000...

Multiple vulnerabilities in Efront

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in Efront, which can be exploited to perform SQL injection and cross-site scripting attacks. 1 Cross-Site scripting XSS vulnerabilities in Efront 1.1 Input passed via the "course" GET parameter to index.php is not...

CVE-2010-4958

SQL injection vulnerability in index.php in Prado Portal 1.2.0 allows remote attackers to execute arbitrary SQL commands via the page parameter...

CVE-2010-4945

SQL injection vulnerability in the CamelcityDB comcamelcitydb2 component 2.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php...

Sql injection

SQL injection vulnerability in the Joostina comezautos component for Joomla! allows remote attackers to execute arbitrary SQL commands via the firstCode parameter in a helpers action to index.php...

Sql injection

SQL injection vulnerability in the Slide Show comslideshow component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php...

Sql injection

SQL injection vulnerability in index.php in WAnewsletter 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter...

Sql injection

SQL injection vulnerability in the Teams comteams component 110281008091711 for Joomla! allows remote attackers to execute arbitrary SQL commands via the PlayerID parameter in a player save action to index.php...

CVE-2010-4930

Cross-site scripting XSS vulnerability in index.php in @mail Webmail before 6.2.0 allows remote attackers to inject arbitrary web script or HTML via the MailType parameter in a mail/auth/processlogin action...

CVE-2010-4939

CVE-2010-4939 is a PHP remote file inclusion vulnerability affecting MailForm 1.2 (index.php). The underlying issue is unsafe handling of the theme parameter, allowing an attacker to include a URL and execute arbitrary PHP code on the server. CVSS v2 base score is 7.5 (HIGH) with network access, ...

CVE-2010-4940

The CVE-2010-4940 entry concerns WAnewsletter 2.1.2, where a flaw in the script index.php enables SQL injection through the id parameter. This allows remote attackers to construct and execute arbitrary SQL commands, with potential partial confidentiality, integrity, and availability impacts as in...

PT-2011-1871

Name of the Vulnerable Software and Affected Versions Joomla! com slideshow component affected versions not specified Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the catid parameter in the index.php API endpoint...

PT-2011-1862

Name of the Vulnerable Software and Affected Versions Joomla! component com restaurantguide version 1.0.0 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the id parameter in a "country" action to "index.php". Recommendations For version 1.0.0, avoid...

PT-2011-1893

Name of the Vulnerable Software and Affected Versions Prado Portal version 1.2.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the page parameter in the "index.php" file. Recommendations For Prado Portal version 1.2.0, consider restricting...

PT-2011-1876

Name of the Vulnerable Software and Affected Versions Joomla! affected versions not specified Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the PlayerID parameter in a player save action to "index.php". Recommendations At the moment, there is no...