EUVD-2008-3181

Malware in sbrugna...

Sql injection

Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 City, 2 Interest, 3 Email, 4 Icq, 5 msn, or 6 Yahoo Messenger field in an editprofile action...

CVE-2008-3191

Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 City, 2 Interest, 3 Email, 4 Icq, 5 msn, or 6 Yahoo Messenger field in an editprofile action...

CVE-2008-3191

Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 City, 2 Interest, 3 Email, 4 Icq, 5 msn, or 6 Yahoo Messenger field in an editprofile action...

CVE-2008-3191

CVE-2008-3191 affects mForum 0.1a. Multiple SQL injection vulnerabilities exist in usercp.php when magic_quotes_gpc is disabled, allowing remote attackers to inject arbitrary SQL via the edit_profile fields (City, Interest, Email, Icq, msn, Yahoo Messenger). The root cause is improper handling of...

CVE-2008-3191: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in usercp.php in mForum 0.1a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 City, 2 Interest, 3 Email, 4 Icq, 5 msn, or 6 Yahoo Messenger field in an editprofile action...

mforum-admin.txt

================================================= MFORUM 0.1a Arbitrary Add-Admin Vulnerability ================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------|...

mForum 'usercp.php' SQL注入漏洞

BUGTRAQ ID: 30214 CNCAN ID：CNCAN-2008071504 mForum是一款基于PHP的WEB应用程序。 mForum不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'usercp.php'脚本对用户提交给WEB参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 mForum 0.1a 目前没有解决方案提供： http://sourceforge.net/projects/marcioforum/...

MFORUM 0.1a Arbitrary Add-Admin Vulnerability

No description provided by source. ================================================= MFORUM 0.1a Arbitrary Add-Admin Vulnerability ================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

MFORUM 0.1a Arbitrary Add-Admin Vulnerability

Exploit for unknown platform in category web applications ============================================= MFORUM 0.1a Arbitrary Add-Admin Vulnerability ============================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

MFORUM 0.1a - Arbitrary Add Admin

MFORUM 0.1a - Arbitrary Add Admin ================================================= MFORUM 0.1a Arbitrary Add-Admin Vulnerability ================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

MFORUM 0.1a - Arbitrary Add Admin

================================================= MFORUM 0.1a Arbitrary Add-Admin Vulnerability ================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------|...