CVE-2019-10763

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges classes permission can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a...

0101SHOP CMS 商城模板存在SQL注入漏洞

CMS在处理浏览器提交的数据时使用filterPara函数过滤，这个函数接着调用了PreventSqlin和Checkxss两个函数进行字符过滤，PreventSqlin用来过滤SQL注入语句，而Checkxss是用来过滤跨站输入。 关键就是在PreventSqlin函数 /inc/AspCmsCommonFun.asp 函数内容如下： Function preventSqlincontent dim sqlStr,sqlArray,i,speStr...

Commix - Automated All-in-One OS Command Injection and Exploitation Tool

Commix short for command injection exploiter has a simple environment and it can be used, from web developers, penetration testers or even security researchers to test web applications with the view to find bugs, errors or vulnerabilities related to command injection attacks. By using this tool, ...

RevSense 1.0 SQL Injection and Cross Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/32624/info RevSense is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to stea...

Sqlmap v.0.9 - automatic SQL injection and database takeover tool !

Sqlmap v.0.9 - automatic SQL injection and database takeover tool ! sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a kick-ass detection engine, many niche features for...

Maxwebportal 1.3 - dl_toprated.asp SQL Injection

Maxwebportal 1.3 - dltoprated.asp SQL Injection source: https://www.securityfocus.com/bid/13466/info MaxWebPortal is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL...

WebCalendar 0.9.45 - SQL Injection

WebCalendar 0.9.45 - SQL Injection source: https://www.securityfocus.com/bid/12581/info WebCalendar is affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could...

[SA12960] IPplan Unspecified SQL Injection Vulnerabilities

TITLE: IPplan Unspecified SQL Injection Vulnerabilities SECUNIA ADVISORY ID: SA12960 VERIFY ADVISORY: http://secunia.com/advisories/12960/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From local network SOFTWARE: IPplan 3.x http://secunia.com/product/4131/ DESCRIPTION: Some...

[BUGZILLA] Multiple vulnerabilities in Bugzilla 2.16.5 and 2.17.7

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bugzilla Security Advisory July 10, 2004 Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers security bugs that have recently been discovered and fixed in the Bugzilla code: In...

MetaDot Portal Server 5.6.x - 'index.pl' Multiple SQL Injections

source: https://www.securityfocus.com/bid/9439/info A number of vulnerabilities have been found in all version of MetaDot Corporation's MetaDot Portal Server. Due to a failure of the software to properly validate user input, an attacker may be able to corrupt data, force the server to disclose...