celerbb 0.0.2 - Multiple Vulnerabilities

Salvatore "drosophila" Fresta + Application: CelerBB + Version: 0.0.2 + Website: http://celerbb.sourceforge.net/ + Bugs: A Multiple SQL Injection B Information Disclosure C Authenticaion Bypass + Exploitation: Remote + Date: 05 Mar 2009 + Discovered by: Salvatore "drosophila" Fresta + Author:...

Sql injection

SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter...

CVE-2009-0810

The vulnerability CVE-2009-0810 affects xGuestbook 2.0, specifically the login.php component where the user parameter is used in a way that permits SQL injection. The advisory states that remote attackers can cause arbitrary SQL commands to execute, indicating a classic injection in authenticatio...

CVE-2009-0810: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter...

CVE-2009-0750

SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to execute arbitrary SQL commands via the username parameter...

Sql injection

SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2009-0750

The CVE affects the txtSQL 2.2 Final suite, specifically the smNews example script’s login.php. The vulnerability is a SQL injection in the username parameter, enabling remote attackers to execute arbitrary SQL commands. Documents confirm the issue is due to improper input handling in login.php, ...

CVE-2009-0750: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in the smNews example script for txtSQL 2.2 Final allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2008-6332

CVE-2008-6332 describes an SQL injection in login.php of Simple Customer 1.2. The vulnerability allows remote attackers to submit a crafted password parameter and execute arbitrary SQL commands, impacting authentication processes and data integrity. The entry notes a high overall severity (CVSS v...

CVE-2008-6326

Summary (CVE-2008-6326): A SQL injection flaw exists in login.php of the Simple Customer software, allowing remote attackers to inject arbitrary SQL via the email parameter. This is the root cause: unsanitized user input in a login routine leading to command execution against the database. Impact...

CVE-2008-6332: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Simple Customer 1.2 allows remote attackers to execute arbitrary SQL commands via the password parameter...

CVE-2008-6326: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Simple Customer as downloaded on 20081118 allows remote attackers to execute arbitrary SQL commands via the email parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.php and 2 rss.php; the query string after the image name in 3 photos/photo; the path parameter to 4 folder.php; page parameter and...

CVE-2008-6295: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Camera Life 2.6.2b8 allow remote attackers to inject arbitrary web script or HTML via the q parameter to 1 search.php and 2 rss.php; the query string after the image name in 3 photos/photo; the path parameter to 4 folder.php; page parameter and...

Sql injection

SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd parameters...

CVE-2009-0738

CVE-2009-0738 describes an SQL injection vulnerability in login.php of Auth Php 1.0, exploitable via the username and passwd parameters. The root cause is unsafely constructed SQL in the login flow that allows attackers to alter SQL semantics or execute arbitrary commands. The vulnerability affec...

CVE-2009-0739

CVE-2009-0739 affects the MyNews 0.10 web application, specifically the login.php component. The vulnerability is a SQL injection in the authentication path, exploitable through the parameters (1) username and (2) passwd, enabling remote attackers to execute arbitrary SQL commands. The CVSS metri...

CVE-2009-0740

SQL injection vulnerability in login.php of BlueBird Prelease can be exploited via (1) username and (2) passwd parameters to execute arbitrary SQL commands. Root cause is improper input handling in the login routine, enabling remote attackers to manipulate queries. Impact per the record indicates...

CVE-2009-0740: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in BlueBird Prelease allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd parameters...

CVE-2009-0738: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Auth Php 1.0 allows remote attackers to execute arbitrary SQL commands via the 1 username and 2 passwd parameters...