MD-Pro 1.083.x - Survey Module pollID Blind SQL Injection

MD-Pro 1.083.x - Survey Module pollID Blind SQL Injection !Informationschema: Product: MDPro v 1.083.x site: www.maxdev.com Vuln: Blind $QL Injection pollID Author: XaDoS thanks to S3rg3770 dork: inurl:modules.php?op= "pollID" "Powered By MDPro" Vuln: PollID...

MDPro My_eGallery模块pid参数SQL注入漏洞

BUGTRAQ ID: 33871 CVECAN ID: CVE-2009-0728 MDPro是一款开放源码的内容管理系统。 MDPro的index.php文件没有正确地过滤对pid参数的输入参数，如果module设置为MyeGallery且do设置为showpic，远程攻击者就可以通过提交恶意请求执行SQL注入攻击。 MAXdev MyeGallery 3.1.1g 厂商补丁： MAXdev ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

CVE-2009-0728

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

Sql injection

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

CVE-2009-0728

The CVE-2009-0728 issue affects MAXdev MDPro (MD-Pro) with the My_eGallery module. The root cause is improper input filtering of the pid parameter in index.php when module=My_eGallery and do=showpic, enabling a remote SQL injection that can execute arbitrary SQL commands. Exploitation details are...

CVE-2009-0728

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

CVE-2009-0728: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the MyeGallery module for MAXdev MDPro MD-Pro and Postnuke allows remote attackers to execute arbitrary SQL commands via the pid parameter in a showpic action to index.php...

MDPro Module My_eGallery (pid) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl read; MDPro Module MyeGallery Remote SQL Injection Exploit by s3rg3770 && yeat - stakerathotmaildotit dork: inurl:module=MyeGallery pid note: works regardless of php.ini settings. read use IO::Socket; my $host,$path,$id = @ARGV; if @ARGV != 3 prin...

MDPro My_eGallery SQL Injection

!/usr/bin/perl $host, PeerPort = 80, Proto = 'tcp' or die $!; $packet .= "GET /$inject HTTP/1.1\r\n"; $packet .= "Host: $host\r\n"; $packet .= "User-Agent: Lynx textmode\r\n"; $packet .= "Connection: close\r\n\r\n"; $socket-send$packet; while $content .= $; close$socket; if $content = /.+?/i prin...

MDPro Module My_eGallery (pid) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications =========================================================== MDPro Module MyeGallery pid Remote SQL Injection Exploit =========================================================== !/usr/bin/perl read; MDPro Module MyeGallery Remote SQL...

MDPro Module My_eGallery - pid SQL Injection

MDPro Module MyeGallery - pid SQL Injection !/usr/bin/perl $host, PeerPort = 80, Proto = 'tcp' or die $!;...

MDPro Module My_eGallery - 'pid' SQL Injection

!/usr/bin/perl $host, PeerPort = 80, Proto = 'tcp' or die $!; $packet .= "GET /$inject HTTP/1.1\r\n"; $packet .= "Host: $host\r\n"; $packet .= "User-...

MDPro cross-site scripting vulnerability

Overview MDPro, an open source content management system, contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solutio...

Sql injection

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

PT-2007-6305 · Maxdev · Maxdev Md-Pro

Name of the Vulnerable Software and Affected Versions: MAXdev MDPro MD-Pro version 1.0.76 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by including a specific substring in the Referer HTTP header. The Firefox ID= substring is used to inject SQ...

CVE-2007-5222: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.76 allows remote attackers to execute arbitrary SQL commands via a "Firefox ID=" substring in a Referer HTTP header...

CVE-2007-5222

CVE-2007-5222 is a SQL injection vulnerability in MAXdev MDPro (MD-Pro) 1.0.76 via a Referer header containing the substring "Firefox ID=", enabling remote attackers to inject arbitrary SQL. The affected component is index.php; root cause is crafted input in Referer header. Impact is partial disc...

mdpro1076-sql.txt

!/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage; if$url = m/^?:http://./ $url = $1;...