MDPro 1.0.76 Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================= MDPro 1.0.76 Remote SQL Injection Exploit ========================================= !/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author =...

MD-Pro 1.0.76 - SQL Injection

MD-Pro 1.0.76 - SQL Injection !/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage; if$url...

MDPro 1.0.76 Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage;...

MDPro index.php topicid Parameter SQL Injection

The remote host is running MDPro, an open source content management system written in PHP. The version of MDPro installed on the remote host fails to sanitize user input to the 'topicid' parameter before using it in the 'topicsuserapiget' function in 'modules/Topics/pnuserapi.php' to generate...

Sql injection

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...

CVE-2007-3938

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...

CVE-2007-3938

The CVE-2007-3938 entry concerns MAXdev MDPro (MD-Pro) prior to version 1.0.8x (before 20070720) where the index.php topicid parameter in the Topics module is not properly sanitized. The flaw allows an unauthenticated remote attacker to influence SQL queries executed by topics_userapi.php, potent...

CVE-2007-3938

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...

CVE-2007-3938: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in MAXdev MDPro MD-Pro 1.0.8x and earlier before 20070720 allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a view action in the Topics module, a different vulnerability than CVE-2006-1676...

MDPro Index.PHP注入漏洞

MDPro是一款基于PHP的WEB应用程序。 MDPro不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是'Index.PHP'脚本对用户提交的'startrow'参数缺少过滤，提交恶意SQL脚本代码作为参数数据，可更改原来的SQL逻辑，导致获得敏感信息。 MAXdev MD-Pro 1.0.76 目前没有解决方案提供,请关注以下链接： http://www.maxdev.com/AboutMD.phtml http://www.example.com/index.php?module=News&startrow='sql injection...

Sql injection

SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow parameter...

CVE-2007-0624

user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' quote character, and possibly other invalid values, in the uname parameter in a userinfo operation...

Design/Logic Flaw

user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' quote character, and possibly other invalid values, in the uname parameter in a userinfo operation...

CVE-2007-0623

SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow parameter...

CVE-2007-0624

user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' quote character, and possibly other invalid values, in the uname parameter in a userinfo operation...

CVE-2007-0624

The CVE-2007-0624 issue affects MAXdev MDPro 1.0.76 (user.php) where the uname parameter in a userinfo operation can be crafted to reveal the server’s full filesystem path by injecting a quote character and possibly other invalid values. The vulnerability could enable information disclosure (part...

CVE-2007-0623

The CVE-2007-0623 entry documents an SQL injection vulnerability in the MAXdev MDPro product, specifically in index.php (version 1.0.76). The root cause is improper handling of the startrow parameter, allowing remote attackers to execute arbitrary SQL commands. The vulnerability affects the web a...

CVE-2007-0623

SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow parameter...

CVE-2007-0624: Undefined Security Weakness

user.php in MAXdev MDPro 1.0.76 allows remote attackers to obtain the full path via a ' quote character, and possibly other invalid values, in the uname parameter in a userinfo operation...

CVE-2007-0623: Undefined Security Weakness

SQL injection vulnerability in index.php in MAXdev MDPro 1.0.76 allows remote attackers to execute arbitrary SQL commands via the startrow parameter...