Bizon-CMS 'photo/index.php' SQL注入漏洞

BUGTRAQ ID: 29770 CNCAN ID：CNCAN-2008061902 Bizon-CMS是一款基于PHP的WEB应用程序。 Bizon-CMS不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题是'photo/index.php'脚本对用户提交给'id'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Bizon-Soft Development Laboratory Bizon-CMS 2.0 漏洞提供者 Mr.SQL [email protected]...

PHP KnowledgeBase Script 2.4 (cat_id) SQL Injection Vulnerability

No description provided by source. PROUD TO BE MUSLIM Remote SQL Injection Vulnerability Knowledge Base Software Overview index.php catid AuTh0r : S.L TEAM FA6@L 3RROR --- H3B@R13H H0ME : WwW.MALAKSOFT.CoM Script : Knowledge Base Software Overview site : www.kblance.com -:: SQL ::- www.site.com/...

phpAuction 3.2.1 (item.php id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ================================================================= phpAuction 3.2.1 item.php id Remote SQL Injection Vulnerability ================================================================= phpauction-gpl Version3.2 Version SQL...

FireAnt 1.3 (index.php page) Local File Inclusion Vulnerability

No description provided by source. Name : FireAnt v1.3 Local File Inclusion Vulnerability Author : cOndemned Dork : use Your brain : Greetz : ZaBeaTy, str0ke, GregStar, irk4z, Sandtalker & Avantura ; Source : // index.php 8. $page = "buglist"; //default page 9. if !empty$GET'page' 10. $page =...

FubarForum 1.5 (index.php page) Local File Inclusion Vulnerability

No description provided by source. Name : FubarForum v1.5 Local File Inclusion Vulnerability Author : cOndemned Dork : for ex. "Powered by FubarForum v1.5" Greetz : TBH, GregStar, ZaBeaTy, irk4z, Hawk, Sandtalker & Avantura ; Source : // index.php 5. if !empty$GET'page' $page = $GET'page'; // ---...

emuCMS 0.3 (cat_id) Remote SQL Injection Vulnerability

No description provided by source. AUTHOR : TurkishWarriorr HOME : http://www.1923turk.org Dork : Powered by emuCMS exploit : index.php?page=category&catid=-9999+union+all+select+1,concatuser,char58,passw ,char58,email,3,null,null,null,7,8,9,10,11,null +from+users-- Test Sites...

phpAuction 3.2.1 - item.php SQL Injection

phpAuction 3.2.1 - item.php SQL Injection phpauction-gpl Version3.2 Version SQL Injection Vulnerability ======================================================== Author: Hussin X = = Home : www.tryag.cc/cc = = email: darkangelg85atYahooDoTcom = hussin.xathotmailDoTcom = =...

Sql injection

SQL injection vulnerability in index.php in eroCMS 1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the site parameter...

CVE-2008-2788

Cross-site scripting XSS vulnerability in index.php in OpenDocMan 1.2.5 allows remote attackers to inject arbitrary web script or HTML via the redirection parameter...

Sql injection

SQL injection vulnerability in index.php in FreeCMS 0.2 allows remote attackers to execute arbitrary SQL commands via the page parameter...

CVE-2008-2788

CVE-2008-2788 is an XSS vulnerability affecting OpenDocMan 1.2.5, reported in multiple sources. The issue resides in index.php, where the redirection parameter can be exploited by remote attackers to inject arbitrary web script or HTML. The vulnerability is described consistently across CVE recor...

CVE-2008-2792

CVE-2008-2792 is a SQL injection vulnerability in eroCMS 1.4 and earlier, affecting index.php where an attacker can inject via the site parameter to execute arbitrary SQL commands. The connected records confirm the affected software (eroCMS prior to 1.4) and the vulnerable component (index.php), ...

CVE-2008-2789

CVE-2008-2789 describes an SQL injection in BASIC-CMS affecting the file pages/index.php via the page_id parameter. The vendor-agnostic description states remote attackers can manipulate SQL commands, enabling arbitrary SQL execution. The available connected data confirms the affected product (BA...

CVE-2008-2796

CVE-2008-2796 concerns a SQL injection in FreeCMS 0.2, triggered via the page parameter in index.php. The vulnerability arises from unsafely composing SQL queries with user-supplied input, allowing remote attackers to execute arbitrary SQL commands. Affected software is FreeCMS 0.2 (index.php: pa...

fubarforum-lfi.txt

Name : FubarForum v1.5 Local File Inclusion Vulnerability Author : cOndemned Dork : for ex. "Powered by FubarForum v1.5" Greetz : TBH, GregStar, ZaBeaTy, irk4z, Hawk, Sandtalker & Avantura ; Source : // index.php 5. if !empty$GET'page' $page = $GET'page'; // ---- $page is being sended using GET...

emuCMS 0.3 - cat_id SQL Injection

emuCMS 0.3 - catid SQL Injection AUTHOR : TurkishWarriorr HOME : http://www.1923turk.org Dork : Powered by emuCMS exploit : index.php?page=category&catid=-9999+union+all+select+1,concatuser,char58,passw ,char58,email,3,null,null,null,7,8,9,10,11,null +from+users-- Test Sites...

FubarForum 1.5 - 'index.php' Local File Inclusion

Name : FubarForum v1.5 Local File Inclusion Vulnerability Author : cOndemned Dork : for ex. "Powered by FubarForum v1.5" Greetz : TBH, GregStar, ZaBeaTy, irk4z, Hawk, Sandtalker & Avantura ; Source : // index.php 5. if !empty$GET'page' $page = $GET'page'; // ---- $page is being sended using GET...

FireAnt 1.3 - 'index.php' Local File Inclusion

Name : FireAnt v1.3 Local File Inclusion Vulnerability Author : cOndemned Dork : use Your brain : Greetz : ZaBeaTy, str0ke, GregStar, irk4z, Sandtalker & Avantura ; Source : // index.php 8. $page = "buglist"; //default page 9. if !empty$GET'page' 10. $page = striptags$GET'page'; 99. if...

FubarForum 1.5 - index.php Local File Inclusion

FubarForum 1.5 - index.php Local File Inclusion Name : FubarForum v1.5 Local File Inclusion Vulnerability Author : cOndemned Dork : for ex. "Powered by FubarForum v1.5" Greetz : TBH, GregStar, ZaBeaTy, irk4z, Hawk, Sandtalker & Avantura ; Source : // index.php 5. if !empty$GET'page' $page =...

BoatScripts Classifieds (index.php type) SQL Injection Vulnerability

No description provided by source. BoatScripts Classifieds Sql INjection By Stack Home v4-team.com poc : http://site.co.il/index.php?type=-1//UNION//SELECT//concatchar58,user,version,database/ live demo tested...