KwsPhp多个SQL注入漏洞

KwsPhp是一款基于PHP的WEB应用程序。 KwsPhp不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL攻击，获得敏感信息或操作数据库。 问题是由于脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，攻击者可以获得敏感信息或操作数据库。 KwsPHP 1.0 目前没有详细解决方案提供： http://koogar.alorys-hebergement.com/kwsphp/index.php http://www.sebug.net/exploit/2357...

kwsmember-sql.txt

!/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $User = $ARGV1; $passwd = $ARGV2; $url = "http://".$host; $port = "80"; print q Script....................: KwsPHP v1.0 MemberSpace Module Script Site...............: http://kws.koogar.org/ Vulnerability.............: Remote SQ...

kwsstats-sql.txt

Script..........................: KwsPHP ver 1.0 stats Module Script Site..................: http://kws.koogar.org/ Vulnerability...............: Remote SQL injection Exploit Access.........................: Remote level.............................: Dangerous Author..........................: S4...

KwsPHP 1.0 sondages Module - SQL Injection

KwsPHP 1.0 sondages Module - SQL Injection KwsPHP 1.0 sondages Module Remote SQL Injection Exploit AUTHOR : H-T Team HouSSamix ToXiC350 HOME : http://no-hack.fr & http://no-hack.net Site: http://kws.koogar.org/ Dork : inurl:index.php?mod=sondages EXPLOITS :...

KwsPHP 1.0 sondages Module - SQL Injection

KwsPHP 1.0 sondages Module Remote SQL Injection Exploit AUTHOR : H-T Team HouSSamix ToXiC350 HOME : http://no-hack.fr & http://no-hack.net Site: http://kws.koogar.org/ Dork : inurl:index.php?mod=sondages EXPLOITS :...

kwssondages-sql.txt

KwsPHP 1.0 sondages Module Remote SQL Injection Exploit AUTHOR : H-T Team HouSSamix ToXiC350 HOME : http://no-hack.fr & http://no-hack.net Site: http://kws.koogar.org/ Dork : inurl:index.php?mod=sondages EXPLOITS :...

KwsPHP 1.0 sondages Module Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================= KwsPHP 1.0 sondages Module Remote SQL Injection Vulnerability ============================================================= KwsPHP 1.0 sondages Module Remote SQL Injection Explo...

CVE-2007-4956: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via 1 the pseudo parameter to login.php, 2 the id parameter to index.php in a carnet editer action in the MemberSpace espacemembre module, or 3 the typenav parameter to index.php in a...

Sql injection

SQL injection vulnerability in play.php in the jeuxflash 1.0 module for KwsPHP allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a play ac action to index.php. NOTE: some details are obtained from third party information...

CVE-2007-4922

SQL injection vulnerability in play.php in the jeuxflash 1.0 module for KwsPHP allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a play ac action to index.php. NOTE: some details are obtained from third party information...

CVE-2007-4922

SQL injection vulnerability in play.php in the jeuxflash 1.0 module for KwsPHP allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a play ac action to index.php. NOTE: some details are obtained from third party information...

CVE-2007-4922

CVE-2007-4922 describes an SQL injection in the jeuxflash 1.0 module for KwsPHP. The vulnerability is in play.php (remote authenticated users) allowing arbitrary SQL execution via the id parameter in a play ac action to index.php. The description notes third-party details were used. Connected rec...

KwsPHP 1.0 (login.php) Remote SQL Injection Exploit

No description provided by source. Script..........................: KwsPHP ver 1.0 Script Site..................: http://kws.koogar.org/ Vulnerability...............: login.php Remote SQL injection Exploit Access.........................: Remote level.............................: Dangerous...

KwsPHP 1.0 stats Module Remote SQL Injection Exploit

No description provided by source. Script..........................: KwsPHP ver 1.0 stats Module Script Site..................: http://kws.koogar.org/ Vulnerability...............: Remote SQL injection Exploit Access.........................: Remote level.............................: Dangerous...

CVE-2007-4922: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in play.php in the jeuxflash 1.0 module for KwsPHP allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a play ac action to index.php. NOTE: some details are obtained from third party information...

KwsPHP 1.0 - login.php SQL Injection

KwsPHP 1.0 - login.php SQL Injection Script..........................: KwsPHP ver 1.0 Script Site..................: http://kws.koogar.org/ Vulnerability...............: login.php Remote SQL injection Exploit Access.........................: Remote level.............................: Dangerous...

KwsPHP 1.0 stats Module - SQL Injection

KwsPHP 1.0 stats Module - SQL Injection Script..........................: KwsPHP ver 1.0 stats Module Script Site..................: http://kws.koogar.org/ Vulnerability...............: Remote SQL injection Exploit Access.........................: Remote level.............................:...

KwsPHP 1.0 Member_Space Module SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $User = $ARGV1; $passwd = $ARGV2; $url = "http://".$host; $port = "80"; print q Script....................: KwsPHP v1.0 MemberSpace Module Script Site...............: http://kws.koogar.org/...

KwsPHP 1.0 stats Module Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ==================================================== KwsPHP 1.0 stats Module Remote SQL Injection Exploit ==================================================== Script..........................: KwsPHP ver 1.0 stats Module Script...

KwsPHP 1.0 Member_Space Module - SQL Injection

KwsPHP 1.0 MemberSpace Module - SQL Injection !/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $User = $ARGV1; $passwd = $ARGV2; $url = "http://".$host; $port = "80"; print q Script....................: KwsPHP v1.0 MemberSpace Module Script Site...............:...