Cross-site Request Forgery (CSRF) Vulnerabilities in osCmax

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in osCmax which could be exploited to perform cross-site request forgery attacks. 1 Cross-site request forgery CSRF in osCmax 1.1 The vulnerability exists due to insufficient validation of the request origin in...

osCMax 2.0 fckeditor upload vulnerability exploit-vulnerability warning-the black bar safety net

osCMax V2. 0 is a powerful e-commerce/shopping cart Web application, there are many benefits, as you are using osCMax e-commerce/shopping cart for your website. It has all it takes to run a successful online store can feature By customizing your In Need of any configuration. osCMax 2.0 is based o...

osCMax 2.0 fckeditor upload vulnerability exploit-vulnerability warning-the black bar safety net

osCMax V2. 0 is a powerful e-commerce/shopping cart Web application, there are many benefits, as you are using osCMax e-commerce/shopping cart for your website. It has all it takes to run a successful online store can feature By customizing your In Need of any configuration. osCMax 2.0 is based o...

osCMax 2.0 - 'FCKeditor' Arbitrary File Upload

Title: osCMax 2.0 fckeditor Remote File Upload Vendor: http://www.oscdox.com Dork: "Powered by osCMax v2.0" , "Copyright @" "RahnemaCo.com" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory:...

osCMax 2.0 Shell Upload

Title: osCMax 2.0 fckeditor Remote File Upload Vendor: http://www.oscdox.com Dork: "Powered by osCMax v2.0" , "Copyright @" "RahnemaCo.com" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com Original Advisory:...

osCMax 2.0 - FCKeditor Arbitrary File Upload

osCMax 2.0 - FCKeditor Arbitrary File Upload Title: osCMax 2.0 fckeditor Remote File Upload Vendor: http://www.oscdox.com Dork: "Powered by osCMax v2.0" , "Copyright @" "RahnemaCo.com" AUTHOR: ITSecTeam Email: [email protected] Website: http://www.itsecteam.com Forum : http://forum.ITSecTeam.com...

osCMax 2.0 (fckeditor) Remote File Upload

Exploit for unknown platform in category web applications ========================================= osCMax 2.0 fckeditor Remote File Upload ========================================= Title: osCMax 2.0 fckeditor Remote File Upload Vendor: http://www.oscdox.com Dork: "Powered by osCMax v2.0" ,...

oscmax-upload.txt

!/usr/bin/perl use strict; use warnings; use LWP::UserAgent; use HTTP::Request::Common; print ; print "Localpath of shellC:/whatever: "; chompmy $file=; my $ua = LWP::UserAgent-new; my $re = $ua-requestPOST $url.'FCKeditor/editor/filemanager/browser/default/connectors/test.html', ContentType =...

Cross site scripting

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-4959

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-4959

CVE-2007-4959 : Cross-site scripting (XSS) in osCMax 2.0.0-RC3-0-1, specifically in catalog_products_with_images.php, allows remote attackers to inject arbitrary web script or HTML via the URI. The description and connected sources confirm the vulnerable component and vector but do not provide re...

CVE-2007-4959

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Hardcoded credentials

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the...

CVE-2006-0478

CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php. NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the...