142 matches found
[SA19563] MAXdev MD-Pro ADOdb "server.php" Insecure Test Script Security Issue
TITLE: MAXdev MD-Pro ADOdb "server.php" Insecure Test Script Security Issue SECUNIA ADVISORY ID: SA19563 VERIFY ADVISORY: http://secunia.com/advisories/19563/ CRITICAL: Moderately critical IMPACT: Security Bypass, System access WHERE: From remote SOFTWARE: MAXdev MD-Pro 1.x...
CVE-2006-1676
MAXdev MDPro MD-Pro
CVE-2006-1676
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro MD-Pro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in...
CVE-2006-1677
MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php...
CVE-2006-1677
CVE-2006-1677 affects MAXdev MDPro versions prior to 1.076, including 1.0.72/1.0.73. Root cause is an insecure direct access path to includes/legacy.php that allows remote attackers to obtain the server’s full filesystem path. Impact is partial confidentiality exposure (full path disclosure) with...
[SA19578] MAXdev MD-Pro "topicid" SQL Injection Vulnerability
TITLE: MAXdev MD-Pro "topicid" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19578 VERIFY ADVISORY: http://secunia.com/advisories/19578/ CRITICAL: Moderately critical IMPACT: Manipulation of data, Exposure of system information WHERE: From remote SOFTWARE: MAXdev MD-Pro 1.x...
CVE-2006-1676: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro MD-Pro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in...
CVE-2006-1677: Exposure of Sensitive Information to an Unauthorized Actor
MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php...
MAXDEV CMS Multiple vulnerabilities
Full Path disclosure --------------------- This hole is caused by direct access to file includes/legacy.php not protected PoC : http://site.co.id/maxdev/includes/legacy.php Fix : Turn off display error in php.ini can fix this security issue Blind sql inject ----------------- This hole is caused b...
MAXDEV CMS 1.0.72/1.0.73 - 'PNuserapi.php' SQL Injection
source: https://www.securityfocus.com/bid/17399/info MAXDEV CMS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...
MAXDEV CMS 1.0.721.0.73 - PNuserapi.php SQL Injection
MAXDEV CMS 1.0.721.0.73 - PNuserapi.php SQL Injection source: https://www.securityfocus.com/bid/17399/info MAXDEV CMS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successfu...
Design/Logic Flaw
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...
CVE-2006-0147
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...
CVE-2006-0147
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including 1 Mantis, 2 PostNuke, 3 Moodle, 4 Cacti, 5 Xaraya, 6 PhpOpenChat, possibly 7 MAXdev MD-Pro, and 8 Simplog, allows remote attackers to execute arbitrary PHP...
PT-2006-1226 · Adodb +9 · Adodb +9
Name of the Vulnerable Software and Affected Versions: ADODB versions prior to 4.70 Mantis versions prior to 1.1.0a PostNuke versions prior to 0.764 Moodle versions prior to 1.5.3 Cacti versions prior to 0.8.6i Xaraya versions prior to 0.98 PHPOpenChat versions prior to 1.0.6 MAXdev MD-Pro versio...
[UNIX] MAXdev MD-Pro Multiple Vulnerabilities (Code Execution, Path Disclosure and CSS)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...
CVE-2005-2887
MAXdev MD-Pro 1.0.73, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to 1 wiki.php, 2 AutoTheme directory, 3 Blocks directory, 4 admin.php, 5 pnadmin.php, or 6 Topics directory, which reveal the path in an error message...
CVE-2005-2886
Multiple cross-site scripting XSS vulnerabilities in MAXdev MD-Pro 1.0.73, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via 1 the print parameter to the print module, the sitename parameter to 2 bbsmilies or 3 bbcoderef module, or 4 the hlpfile...
CVE-2005-2885
The Downloads page in MAXdev MD-Pro 1.0.73, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which could allow remote attackers to bypass file extension checks and execute arbitrary commands by uploading a file with a different extension, as...
CVE-2005-2886
Multiple cross-site scripting XSS vulnerabilities in MAXdev MD-Pro 1.0.73, and possibly earlier versions, allow remote attackers to inject arbitrary web script or HTML via 1 the print parameter to the print module, the sitename parameter to 2 bbsmilies or 3 bbcoderef module, or 4 the hlpfile...