CVE-2006-5474: Undefined Security Weakness

The "forgot password" function in OneOrZero Helpdesk before 1.6.5.4 generates insecure passwords by concatenating the current timestamp with the username, which allows remote attackers to gain access as an arbitrary user by requesting a password reset...

Advisory for Oneorzero helpdesk

Permanant Link : http://www.whitedust.net/speaks/3043/ ------------------------------------------------------------ - Advisory for OneOrZero Helpdesk - ------------------------------------------------------------ - OneOrZero Helpdesk - AFFECTED PRODUCTS ================= OneOrZero Helpdesk v1.6.0...

OneOrZero.txt

vendor: http://www.oneorzero.com/ vuln : http://host/supporter/index.php?t=tupd&id=SQL http://host/supporter/index.php?t=tupd&id=XSS Author : Vampire [email protected] Homepage : Www.HackerZ.iR Www.H4ckerZ.Com Iran HackerZ Security Team...

CVE-2006-4350

SQL injection vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-4351

Cross-site scripting XSS vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2006-4350

SQL injection vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-4351

Cross-site scripting XSS vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2006-4350

The CVE-2006-4350 issue affects OneOrZero 1.6.4.1 where a flaw in index.php allows SQL injection through the id parameter. The underlying root cause is improper handling of user-supplied input in a SQL query, enabling remote commands execution. Documented impact indicates partial confidentiality,...

CVE-2006-4351

The CVE-2006-4351 entry concerns a cross-site scripting (XSS) vulnerability in OneOrZero 1.6.4.1, found in index.php, exploitable by supplying a crafted id parameter to inject arbitrary script/HTML. The attached CVSS data assigns a base score of 6.8 (MEDIUM) with network attack vector, no authent...

CVE-2006-4350: Undefined Security Weakness

SQL injection vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2006-4351: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in OneOrZero 1.6.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

OneOrZero Helpdesk V1.6.4.1 susceptible to SQL injection and XSS

vendor: http://www.oneorzero.com/ vuln : http://host/supporter/index.php?t=tupd&id=SQL http://host/supporter/index.php?t=tupd&id=XSS Author : Vampire [email protected] Homepage : Www.HackerZ.iR Www.H4ckerZ.Com Iran HackerZ Security Team...

Sql injection

SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action...

CVE-2006-1501

SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action...

CVE-2006-1501: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action...

CVE-2006-1501

SQL injection vulnerability in index.php in OneOrZero 1.6.3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, possibly in the kans action...

CVE-2006-1501

CVE-2006-1501 describes a SQL injection in OneOrZero 1.6.3.0, where the vulnerable vector is the id parameter (possibly in the kans action) in index.php. The vulnerability allows remote attackers to alter SQL commands; CVSS v2 base score is 7.5 ( HIGH ) with network access, low attack complexity,...

[SA19446] OneOrZero "id" SQL Injection Vulnerability

TITLE: OneOrZero "id" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA19446 VERIFY ADVISORY: http://secunia.com/advisories/19446/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: OneOrZero Helpdesk 1.x http://secunia.com/product/1568/ DESCRIPTION: Preddy...

OneOrZero 1.6.3 Helpdesk - 'index.php' SQL Injection

source: https://www.securityfocus.com/bid/17298/info OneOrZero Helpdesk is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromis...

OneOrZero 1.6.3 Helpdesk - index.php SQL Injection

OneOrZero 1.6.3 Helpdesk - index.php SQL Injection source: https://www.securityfocus.com/bid/17298/info OneOrZero Helpdesk is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. A...