Sql injection

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

CVE-2009-0728

The CVE-2009-0728 issue affects MAXdev MDPro (MD-Pro) with the My_eGallery module. The root cause is improper input filtering of the pid parameter in index.php when module=My_eGallery and do=showpic, enabling a remote SQL injection that can execute arbitrary SQL commands. Exploitation details are...

CVE-2009-0728

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

MDPro Module My_eGallery (pid) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl read; MDPro Module MyeGallery Remote SQL Injection Exploit by s3rg3770 && yeat - stakerathotmaildotit dork: inurl:module=MyeGallery pid note: works regardless of php.ini settings. read use IO::Socket; my $host,$path,$id = @ARGV; if @ARGV != 3 prin...

MDPro Module My_eGallery (pid) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications =========================================================== MDPro Module MyeGallery pid Remote SQL Injection Exploit =========================================================== !/usr/bin/perl read; MDPro Module MyeGallery Remote SQL...

MDPro My_eGallery SQL Injection

!/usr/bin/perl $host, PeerPort = 80, Proto = 'tcp' or die $!; $packet .= "GET /$inject HTTP/1.1\r\n"; $packet .= "Host: $host\r\n"; $packet .= "User-Agent: Lynx textmode\r\n"; $packet .= "Connection: close\r\n\r\n"; $socket-send$packet; while $content .= $; close$socket; if $content = /.+?/i prin...

MDPro Module My_eGallery - pid SQL Injection

MDPro Module MyeGallery - pid SQL Injection !/usr/bin/perl $host, PeerPort = 80, Proto = 'tcp' or die $!;...

MDPro Module My_eGallery - 'pid' SQL Injection

!/usr/bin/perl $host, PeerPort = 80, Proto = 'tcp' or die $!; $packet .= "GET /$inject HTTP/1.1\r\n"; $packet .= "Host: $host\r\n"; $packet .= "User-...

MDPro cross-site scripting vulnerability

Overview MDPro, an open source content management system, contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solutio...

Sql injection

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

PT-2007-6305 · Maxdev · Maxdev Md-Pro

Name of the Vulnerable Software and Affected Versions: MAXdev MDPro MD-Pro version 1.0.76 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by including a specific substring in the Referer HTTP header. The Firefox ID= substring is used to inject SQ...

CVE-2007-5222

CVE-2007-5222 is a SQL injection vulnerability in MAXdev MDPro (MD-Pro) 1.0.76 via a Referer header containing the substring "Firefox ID=", enabling remote attackers to inject arbitrary SQL. The affected component is index.php; root cause is crafted input in Referer header. Impact is partial disc...

mdpro1076-sql.txt

!/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage; if$url = m/^?:http://./ $url = $1;...

MDPro 1.0.76 Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================= MDPro 1.0.76 Remote SQL Injection Exploit ========================================= !/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author =...

MD-Pro 1.0.76 - SQL Injection

MD-Pro 1.0.76 - SQL Injection !/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage; if$url...

MDPro 1.0.76 Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage;...

MDPro index.php topicid Parameter SQL Injection

The remote host is running MDPro, an open source content management system written in PHP. The version of MDPro installed on the remote host fails to sanitize user input to the 'topicid' parameter before using it in the 'topicsuserapiget' function in 'modules/Topics/pnuserapi.php' to generate...

Sql injection

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...