OemPro 3.6.4 - Multiple Vulnerabilities

Exploit title: Multiple vulnerabilities on OemPro Product: OemPro Version Affected: v3.6.4 and probably prior. Date: 03/02/2011 Author: Ignacio Garrido Vendor: http://octeth.com Tested on: Linux - Windows 2003 Mail: [email protected] Path disclosure: http://localhost/clibounce.php FCKEditor 2.3.2...

Oempro index.php FormValue_Email Parameter SQL Injection Authentication Bypass

The remote host is running Oempro, a commercial list management and email marketing application written in PHP. The installed version of Oempro fails to sanitize user-supplied input to the 'FormValueEmail' parameter of the 'index.php' script before using it in a database query. An unauthenticated...

CVE-2008-3059

member/settingsaccount.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in the FormValuePassword field, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to the "Settings -...

CVE-2008-3058

Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arbitrary SQL commands via the FormValueEmail parameter aka Email field to index.php in 1 member/, 2 client/, or 3 admin/; or 4 the FormValueSearchKeywords...

Sql injection

Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arbitrary SQL commands via the FormValueEmail parameter aka Email field to index.php in 1 member/, 2 client/, or 3 admin/; or 4 the FormValueSearchKeywords...

CVE-2008-3057

Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Design/Logic Flaw

Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2008-3057

Octeth Oempro 3.5.5.1, and possibly other versions before 4, does not set the secure flag for the PHPSESSID cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2008-3057

The CVE-2008-3057 entry concerns Octeth Oempro 3.5.5.1 (and possibly versions before 4). The underlying issue is that the PHPSESSID cookie is not marked Secure in HTTPS sessions, which allows an attacker to capture the cookie by intercepting its transmission over HTTP. The available documents con...

CVE-2008-3058

The CVE-2008-3058 entry concerns SQL injection in Octeth Oempro 3.5.5.1 (and possibly earlier versions before 4). The vulnerability arises from unsanitized input in the FormValue_Email parameter (the Email field) passed to index.php in the member/, client/, or admin/ directories, and in FormValue...

CVE-2008-3058

Multiple SQL injection vulnerabilities in Octeth Oempro 3.5.5.1, and possibly other versions before 4, allow remote attackers to execute arbitrary SQL commands via the FormValueEmail parameter aka Email field to index.php in 1 member/, 2 client/, or 3 admin/; or 4 the FormValueSearchKeywords...

CVE-2008-3059

CVE-2008-3059 affects Octeth OEMpro 3.5.5.1 and possibly earlier versions before 4. The Settings - Account Information form transmits the password in plaintext (cleartext), potentially allowing remote attackers to obtain credentials by sniffing network traffic. The documents do not specify exact ...

CVE-2008-3059

member/settingsaccount.php in Octeth Oempro 3.5.5.1, and possibly other versions before 4, uses cleartext to transmit a password entered in the FormValuePassword field, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to the "Settings -...

Octeth Oempro 3.5.5 - Multiple SQL Injections

Octeth Oempro 3.5.5 - Multiple SQL Injections source: https://www.securityfocus.com/bid/32784/info Octeth Oempro is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an...

Octeth Oempro 3.5.5 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/32784/info Octeth Oempro is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access...