Multiple vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax, which can be exploited to perform SQL Injection and Cross-Site Scripting XSS attacks. 1 Multiple Cross-Site Scripting XSS in osCmax: CVE-2012-1664 1.1 Input passed via the "username" POST parameter to...

osCMax 2.0 - articles.php Cross-Site Scripting

osCMax 2.0 - articles.php Cross-Site Scripting source: https://www.securityfocus.com/bid/40998/info osCmax is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browse...

osCMax 2.0 - 'articles.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/40998/info osCmax is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

Cross-site Request Forgery (CSRF) Vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF in osCmax 1.1 The vulnerability exists due to insufficient validation of the request origin in...

osCMax 2.0 fckeditor upload vulnerability exploit-vulnerability warning-the black bar safety net

osCMax V2. 0 is a powerful e-commerce/shopping cart Web application, there are many benefits, as you are using osCMax e-commerce/shopping cart for your website. It has all it takes to run a successful online store can feature By customizing your In Need of any configuration. osCMax 2.0 is based o...

osCMax 2.0 fckeditor upload vulnerability exploit-vulnerability warning-the black bar safety net

osCMax V2. 0 is a powerful e-commerce/shopping cart Web application, there are many benefits, as you are using osCMax e-commerce/shopping cart for your website. It has all it takes to run a successful online store can feature By customizing your In Need of any configuration. osCMax 2.0 is based o...

osCMax 2.0 - 'FCKeditor' Arbitrary File Upload

Title: osCMax 2.0 fckeditor Remote File Upload Vendor: http://www.oscdox.com Dork: "Powered by osCMax v2.0" , "Copyright @" "RahnemaCo.com" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory:...

osCMax 2.0 - FCKeditor Arbitrary File Upload

osCMax 2.0 - FCKeditor Arbitrary File Upload Title: osCMax 2.0 fckeditor Remote File Upload Vendor: http://www.oscdox.com Dork: "Powered by osCMax v2.0" , "Copyright @" "RahnemaCo.com" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com...

osCMax 2.0 (fckeditor) Remote File Upload

Exploit for unknown platform in category web applications ========================================= osCMax 2.0 fckeditor Remote File Upload ========================================= Title: osCMax 2.0 fckeditor Remote File Upload Vendor: http://www.oscdox.com Dork: "Powered by osCMax v2.0" ,...

osCMax 2.0 Shell Upload

Title: osCMax 2.0 fckeditor Remote File Upload Vendor: http://www.oscdox.com Dork: "Powered by osCMax v2.0" , "Copyright @" "RahnemaCo.com" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory:...

oscmax-upload.txt

!/usr/bin/perl use strict; use warnings; use LWP::UserAgent; use HTTP::Request::Common; print ; print "Localpath of shellC:/whatever: "; chompmy $file=; my $ua = LWP::UserAgent-new; my $re = $ua-requestPOST $url.'FCKeditor/editor/filemanager/browser/default/connectors/test.html', ContentType =...

Cross site scripting

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-4959

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-4959

CVE-2007-4959 : Cross-site scripting (XSS) in osCMax 2.0.0-RC3-0-1, specifically in catalog_products_with_images.php, allows remote attackers to inject arbitrary web script or HTML via the URI. The description and connected sources confirm the vulnerable component and vector but do not provide re...

CVE-2007-4959

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-4959: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Hardcoded credentials

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the...

CVE-2006-0478

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the...