7217 matches found
CVE-2008-3603
SQL injection vulnerability in index.php in Vacation Rental Script 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a sections action...
Vacation Rental Script 'index.php' SQL注入漏洞
BUGTRAQ ID:30626 CNCAN ID：CNCAN-2008081206 Vacation Rental Script是一款基于PHP的WEB应用程序。 Vacation Rental Script不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或操作数据库。 问题是由于'index.php'脚本不正确过滤"id"参数，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，可获得敏感信息或操作数据库。 vacationrentalscript.com Vacation Rentals Script 3.0 目前没有解决方案提供：...
Sql injection
Multiple SQL injection vulnerabilities in phsBlog 0.1.1 allow remote attackers to execute arbitrary SQL commands via the 1 eid parameter to comments.php, 2 cid parameter to index.php, and the 3 urltitle parameter to entries.php...
CVE-2008-3564
The CVE-2008-3564 entry concerns multiple directory traversal flaws in Dayfox Blog 4’s index.php. The vulnerability allows remote attackers to include and execute arbitrary local files by manipulating the dot-dot sequences in the (1) p, (2) cat, and (3) archive parameters. In some environments th...
CVE-2008-3570
CVE-2008-3570 affects Africa Be Gone (ABG) 1.0a. The vulnerability is a PHP remote file inclusion in index.php exploited via the abg_path parameter, enabling an attacker to execute arbitrary PHP code by supplying a URL. The capabilites and impact are described in the NVD entry (base score 7.5, HI...
CVE-2008-3566
CVE-2008-3566 describes a cross-site scripting (XSS) vulnerability in ZoneO-soft freeForum 1.7. The issue allows remote attackers to inject arbitrary web script or HTML via the acuparam parameter to (1) the default URI, (2) index.php, or (3) the PATH_INFO to index.php. The available documents con...
CVE-2008-3556
Multiple SQL injection vulnerabilities in index.php in Battle.net Clan Script 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 showmember parameter in a members action and the 2 thread parameter in a board action. NOTE: vector 1 might be the same as CVE-2008-2522...
CVE-2008-3556
Multiple SQL injection vulnerabilities in index.php in Battle.net Clan Script 1.5.2 allow remote attackers to execute arbitrary SQL commands via the 1 showmember parameter in a members action and the 2 thread parameter in a board action. NOTE: vector 1 might be the same as CVE-2008-2522...
CVE-2008-3556
CVE-2008-3556 covers multiple SQL injection vulnerabilities in index.php of Battle.net Clan Script 1.5.2. Exploitation targets include the showmember parameter in the members action and the thread parameter in the board action, enabling remote execution of arbitrary SQL commands. The entry notes ...
Request It 1.0 (index.php id) Remote File Inclusion Vulnerability
No description provided by source. Request It v1.0 Remote File Inclusion Vulnerability Ghost Hacker , R-h Team , Real Hack We Will Be Back Soon : Found by : Ghost Hacker |, .-. .-. ,| My Home : Real Hack We Will Be Back Soon & v4-Team.com | o/ \o | My Blog : http://gh0st10.wordpress.com |/ /\ | M...
Sql injection
SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter in a showcat action to index.php...
CVE-2008-3484
SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter in a showcat action to index.php...
dayfox-lfi.txt
..:::::Dayfox Blog LOCAL FILE INCLUSION Vulnerbility ::::... Virangar Security Team www.virangar.net -------- Discoverd By :Virangar Security Team hadihadi special tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra & all virangar members & all iranian hackerz greetz:to my best friend in the...
CVE-2008-3448
Cross-site scripting XSS vulnerability in index.php in common solutions csphonebook 1.02 allows remote attackers to inject arbitrary web script or HTML via the letter parameter...
CVE-2008-3448
CVE-2008-3448 describes a cross-site scripting (XSS) vulnerability in the web application feature: index.php in the product “csphonebook 1.02” from common solutions . The issue arises when an attacker supplies a crafted value in the letter parameter, allowing injection of arbitrary web script or ...
syzygyCMS 0.3 (index.php page) Local File Inclusion Vulnerability
Exploit for unknown platform in category web applications ================================================================= syzygyCMS 0.3 index.php page Local File Inclusion Vulnerability ================================================================= + syzygyCMS 0.3 Local File Inclusion +...
CVE-2008-3405
CVE-2008-3405 describes a directory traversal vulnerability in the nzFotolog web application ( Ricardo Amaral nzFotolog 0.4.1 ). The flaw is in index.php where attackers can craft the action_file parameter to traverse directories and include/execute arbitrary local files on the server. Impact is ...
EPShop 'index.php' SQL注入漏洞
BUGTRAQ ID: 30387 CNCAN ID：CNCAN-2008072903 EPShop是一款基于PHP的WEB应用程序。 EPShop不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息或操作数据库。 问题是'index.php'脚本对用户提交的'pid'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 EPShop 目前没有解决方案提供： http://comsenz.com/products/ecshop...
[DSECRG-08-033] Local File Include Vulnerability in Pixelpost 1.7.1
Digital Security Research Group DSecRG Advisory DSECRG-08-033 Application: Pixelpost photoblog Versions Affected: 1.7.1 Vendor URL: http://www.pixelpost.org/ Bug: Local File Include Exploits: YES Reported: 22.07.2008 Vendor response: 23.07.2008 Solution: YES Date of Public Advisory: 28.07.2008...