帝国ECMS V5 /e/member/list/index.php注入漏洞

帝国ECMS /e/member/list/index.php文件: if$sear $keyboard=RepPostVar2$GET'keyboard'; if$keyboard $add.=$where.$userusername." like '%$keyboard%'"; $search.="&sear=1&keyboard=$keyboard"; 判断sear参数是否存在,然后直接去keyboard的参数,然后再判断keyboard值是否为空,如果不为 空就直接把keyboard带入查询产生注射漏洞. 帝国ECMS V5 暂无...

PHPcounter 1.3.2 - 'index.php' SQL Injection

!/usr/bin/php -q milw0rm.com 2008-09-28...

plugspace-lfi.txt

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl PlugSpace v0.1 Local File Inclusion Vulnerability Download: http://sourceforge.net/projects/plugspace/ Vuln:...

PlugSpace 0.1 - navi Local File Inclusion

PlugSpace 0.1 - navi Local File Inclusion :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl PlugSpace v0.1 Local File Inclusion Vulnerability Download:...

PlugSpace 0.1 (index.php navi) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================= PlugSpace 0.1 index.php navi Local File Inclusion Vulnerability ================================================================= :::::::-. ... ::::::. :::. ;;, ';, ;;...

PlugSpace 0.1 - 'navi' Local File Inclusion

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl PlugSpace v0.1 Local File Inclusion Vulnerability Download: http://sourceforge.net/projects/plugspace/ Vuln:...

phpOCS <= 0.1-beta3 (index.php act) Local File Inclusion Vulnerability

No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl phpOCS = 0.1-beta3 Local File Inclusion Vulnerability Script: "phpOCS is a fully featured Online...

phpOCS <= 0.1-beta3 (index.php act) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ====================================================================== phpOCS = 0.1-beta3 index.php act Local File Inclusion Vulnerability ====================================================================== :::::::-. ... ::::::. :::. ;;...

CVE-2008-4205

CVE-2008-4205 concerns SQL injection in Attachmax Dolphin

CVE-2008-4202

Affected software: Gonafish LinksCaffePRO 4.5. The CVE-2008-4202 vulnerability is an SQL injection in index.php via the idd parameter in a deadlink action. Root cause: improper handling of user-supplied input leading to arbitrary SQL execution. Impact: remote attacker could manipulate the databas...

Ol BookMarks Manager 0.7.5 - Local File Inclusion Remote File Inclusion SQL Injection

Ol BookMarks Manager 0.7.5 - Local File Inclusion Remote File Inclusion SQL Injection Ol Bookmarks Manager 0.7.5 RFI / LFI / SQL Injection Vulnerabilities POC & Vulns RFI In frame.php In Line 46 include "$GETframefile"; Ex : /frame.php?framefile=Shell LFI In /read/frame.php In Line 46 include...

Diesel Pay 'index.php' SQL注入漏洞

BUGTRAQ ID: 31276 CNCAN ID：CNCAN-2008092304 Diesel Pay是一款基于PHP的WEB应用程序。 Diesel Pay不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'index.php'脚本对用户提交给'aera'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 DieselScripts Diesel Pay 目前没有解决方案提供： http://www.dieselscripts.com/diesel-pay.html...

Plaincart 'index.php' SQL注入漏洞

BUGTRAQ ID: 31275 CNCAN ID：CNCAN-2008092313 Plaincart是一款基于PHP的WEB应用程序。 Plaincart不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'index.php'脚本对用户提交给'p'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 PlainCart 1.1.2 目前没有解决方案提供： http://www.phpwebcommerce.com/shopping-cart-source-code.php...

olbookmarks-rfilfisql.txt

Ol Bookmarks Manager 0.7.5 RFI / LFI / SQL Injection Vulnerabilities POC & Vulns RFI In frame.php In Line 46 include "$GETframefile"; Ex : /frame.php?framefile=Shell LFI In /read/frame.php In Line 46 include "../$GETframefile"; Ex : /frame.php?framefile=../../../../../../etc/passwd SQL Injection ...

Ol Bookmarks Manager 0.7.5 RFI / LFI / SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications ==================================================================== Ol Bookmarks Manager 0.7.5 RFI / LFI / SQL Injection Vulnerabilities ==================================================================== Ol Bookmarks Manager 0.7.5 RFI /...

ADN Forum <= 1.0b Insecure Cookie Handling Vulnerability

Exploit for unknown platform in category web applications ======================================================== ADN Forum = 1.0b Insecure Cookie Handling Vulnerability ======================================================== -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- adnforum =...

CVE-2008-4187

CVE-2008-4187 affects ProActive CMS via a directory traversal in index.php, enabling remote attackers to read arbitrary files by supplying .. in the template parameter. Multiple connected records corroborate the vulnerability and its basic effect (read access); however, none of the provided docum...

CVE-2008-4174

Multiple cross-site scripting XSS vulnerabilities in index.php in Dynamic MP3 Lister 2.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 currentpath, 2 invert, 3 search, and 4 sort parameters...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in webCMS Portal Edition allows remote attackers to inject arbitrary web script or HTML via the patron parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Sql injection

SQL injection vulnerability in index.php in webCMS Portal Edition allows remote attackers to execute arbitrary SQL commands via the id parameter in a documentos action, a different vector than CVE-2008-3213...