SQL injection vulnerability in foods_order.class.php page of UQCMS Cloud B2B2C multi-store system

B2B2C multi-store system is a B2B2C e-commerce software with PHP+MYSQL program and smarty template. A SQL injection vulnerability exists in the goodsorder.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System. The vulnerability stems from the fact that the program does not adequatel...

Food Order Script 1.0 SQL Injection

Exploit Title: Food Order Script 1.0 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/food-order-script-2/ Demo: http://ordermanagementscript.com/demo/food-order/ Version: 1.0 Category: Webapps Tested...

Food Order Script 1.0 - list?city SQL Injection

Food Order Script 1.0 - list?city SQL Injection Exploit Title: Food Order Script 1.0 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/food-order-script-2/ Demo:...

TPshop 前台SQL注入#1

0x01 说明 TPshop开源商城系统 Thinkphp shop的简称 ，是深圳搜豹网络有限公司开发的一套多商家模式的商城系统。适合企业及个人快速构建个性化网上商城。包含PC+IOS客户端+Adroid客户端+微商城，系统PC+后台是基于ThinkPHP5 MVC构架开发的跨平台开源软件，设计得非常灵活，具有模块化架构体系和丰富的功能，易于与第三方应用系统无缝集成，在设计上，包含相当全面，以模块化架构体系，让应用组合变得相当灵活，功能也相当丰富。 下载地址：http://www.tp-shop.cn/Index/Index/download.html 目录大概结构 ├─index.p...

Threat Outbreak Alert RuleID31383: Email Messages Distributing Malicious Software on November 22, 2017

Medium Alert ID: 56018 First Published: 2017 November 22 14:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31383 may contain the following files: Name |...

Threat Outbreak Alert RuleID31313: Email Messages Distributing Malicious Software on November 15, 2017

Medium Alert ID: 55936 First Published: 2017 November 15 20:28 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31313 may contain the following files: Name |...

Threat Outbreak Alert RuleID31294: Email Messages Distributing Malicious Software on November 14, 2017

Medium Alert ID: 55916 First Published: 2017 November 14 14:56 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31294 may contain the following files: Name |...

Threat Outbreak Alert RuleID31283: Email Messages Distributing Malicious Software on November 14, 2017

Medium Alert ID: 55908 First Published: 2017 November 14 14:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31283 may contain the following files: Name |...

siteground.com XSS vulnerability

Vulnerable URL: https://www.siteground.com/reseller/order.htm Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4404 VIP website status:| Yes Coordinated Disclosure Timeline: Description| Value ---|--- Vulnerabilit...

BOHEMIA INTERACTIVE a.s.: IDOR to view User Order Information

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to verify and then potentially issue a bounty, so be sure to take your time filling out the report! Description: There is a...

Tuleap 9.6 Second-Order PHP Object Injection

This module exploits a Second-Order PHP Object Injection vulnerability in Tuleap 'Tuleap 9.6 Second-Order PHP Object Injection', 'Description' = %q This module exploits a Second-Order PHP Object Injection vulnerability in Tuleap = 9.6 which could be abused by authenticated users to execute...

Worry-Free Shopping System ASP General Edition has multiple vulnerabilities

Hassle-free shopping system ASP General Edition is a shopping site based on ASP/Access development of general management system set up. Worry-Free Shopping System ASP General Edition is vulnerable to default database download, arbitrary user login, multiple stored cross-site scripts, payment desi...

GHSA-XQG8-CV3H-XPPV SQL Injection in sequelize

Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 or later...

SQL Injection in sequelize

Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 or later...

sabaq.pk XSS vulnerability

Vulnerable URL: http://www.sabaq.pk/card-order/order-customer.php Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 31909 VIP website status:| Yes Coordinated Disclosure Timeline: Description| Value ---|---...

Threat Outbreak Alert RuleID31056: Email Messages Distributing Malicious Software on October 23, 2017

Medium Alert ID: 55666 First Published: 2017 October 23 13:53 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31056 may contain the following files: Name |...

CVE-2017-10329

Vulnerability in the Oracle Global Order Promising component of Oracle E-Business Suite subcomponent: Reschedule Sales Orders. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attack...

CVE-2017-10329

Vulnerability in the Oracle Global Order Promising component of Oracle E-Business Suite subcomponent: Reschedule Sales Orders. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attack...

Design/Logic Flaw

Vulnerability in the Oracle Global Order Promising component of Oracle E-Business Suite subcomponent: Reschedule Sales Orders. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attack...

CVE-2017-10329

Vulnerability in the Oracle Global Order Promising component of Oracle E-Business Suite subcomponent: Reschedule Sales Orders. Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attack...