2374 matches found
CVE-2006-6377
CVE-2006-6377 contributes a remote-access issue in Uploadscript 1.2 and earlier. The description states that sensitive data is stored under the web root with insufficient access control, enabling remote attackers to obtain the admin password hash by directly requesting /password.txt. The NVD note...
[Full-disclosure] Coppermine 1.4.9 SQL injection
// http://www.w4cking.com CREDIT: w4ck1ng.com PRODUCT: Coppermine 1.4.9 http://coppermine-gallery.net/ VULNERABILITY: SQL Injection NOTES: - SQL injection can be used to obtain password hash - You must be a registered user to access the vulnerable page, picmgr.php. - The table prefix must be know...
Coppermine1.4.9.txt
// http://www.w4cking.com CREDIT: w4ck1ng.com PRODUCT: Coppermine 1.4.9 http://coppermine-gallery.net/ VULNERABILITY: SQL Injection NOTES: - SQL injection can be used to obtain password hash - You must be a registered user to access the vulnerable page, picmgr.php. - The table prefix must be know...
Simplog0.9.3.1.txt
// http://www.w4cking.com CREDIT: w4ck1ng.com PRODUCT: Simplog 0.9.3.1 http://www.simplog.org/ VULNERABILITY: SQL Injection NOTES: - SQL injection can be used to obtain password hash - requires at least one blog entry POC:...
Simplog 0.9.3.1 SQL Injection
// http://www.w4cking.com CREDIT: w4ck1ng.com PRODUCT: Simplog 0.9.3.1 http://www.simplog.org/ VULNERABILITY: SQL Injection NOTES: - SQL injection can be used to obtain password hash - requires at least one blog entry POC: host/path/comments.php?op=edit&cid=120union20select209,9,9,login,...
moodle162.txt
// http://www.w4cking.com Product: moodle 1.6.2 http://www.moodle.org Vulnerability: SQL injection Notes: - SQL injection can be used to obtain password hash - the moodle blog "module" must be enabled - guest access to the blog must be enabled POC:...
SQL injection - moodle
// http://www.w4cking.com Product: moodle 1.6.2 http://www.moodle.org Vulnerability: SQL injection Notes: - SQL injection can be used to obtain password hash - the moodle blog "module" must be enabled - guest access to the blog must be enabled POC:...
trforum20.txt
!/usr/bin/perl Affected.scr..: Tr Forum V2.0 Poc.ID........: 10060903 Type..........: SQL Injection, Bypass Security Restriction Risk.level....: Medium Vendor.Status.: Unpatched Src.download..: comscripts.com/scripts/php.tr-forum.1579.html Poc.link......: acid-root.new.fr/poc/10060903.txt...
CVE-2006-3837
delcookie.php in Professional Home Page Tools Guestbook changes the expiration date of a cookie instead of deleting the cookie's value, which makes it easier for attackers to steal the cookie and obtain the administrator's password hash after logout...
CVE-2006-3837
CVE-2006-3837 affects the Guestbook component of Professional Home Page Tools. The vulnerable code path in the delcookie.php script alters a cookie’s expiration date instead of deleting its value, enabling an attacker to more easily retrieve the cookie and, after logout, obtain the administrator’...
CVE-2006-3837: Undefined Security Weakness
delcookie.php in Professional Home Page Tools Guestbook changes the expiration date of a cookie instead of deleting the cookie's value, which makes it easier for attackers to steal the cookie and obtain the administrator's password hash after logout...
CVE-2006-3753: Undefined Security Weakness
setcookie.php for the administration login in Professional Home Page Tools Guestbook records the hash of the administrator password in a cookie, which allows attackers to conduct brute force password guessing attacks after obtaining the hash...
security flaw
The cryptgensalt functions for BSDI-style extended DES-based and FreeBSD-sytle MD5-based password hashes in cryptblowfish 0.4.7 and earlier do not evenly and randomly distribute salts, which makes it easier for attackers to guess passwords from a stolen password file due to the increased number o...
DeluxeBB 1.06 - 'name' SQL Injection (mq=off)
!/usr/bin/perl use IO::Socket; print q DeluxeBB 1.06 Remote SQL Injection Exploit exploit discovered and coded by KingOfSka http://contropotere.netsons.org ; if !$ARGV2 print q Usage: perl dbbxpl.pl host /directory/ victimuserid perl dbbxpl.pl www.somesite.com /forum/ 1 ; $server = $ARGV0; $dir =...
invision215-SQL.txt
!/usr/bin/perl IPB =2.1.4 exploit possibly 2.1.5 too Brought to you by the Ykstortion security team. The bug is in the pm system so you must have a registered user. The exploit will extract a password hash from the forum's data base of the target user. You need to know the target user's member ID...
Invision Power Board <= 2.1.5 (from_contact) SQL Injection Exploit
Exploit for unknown platform in category web applications ================================================================== Invision Power Board = 2.1.5 fromcontact SQL Injection Exploit ================================================================== !/usr/bin/perl IPB =2.1.4 exploit possibly...
Invision Power Board <= 2.1.5 (from_contact) SQL Injection Exploit
No description provided by source. !/usr/bin/perl IPB =2.1.4 exploit possibly 2.1.5 too Brought to you by the Ykstortion security team. The bug is in the pm system so you must have a registered user. The exploit will extract a password hash from the forum's data base of the target user. You need ...
Invision Power Board 2.1.5 - 'from_contact' SQL Injection
!/usr/bin/perl IPB =2.1.4 exploit possibly 2.1.5 too Brought to you by the Ykstortion security team. The bug is in the pm system so you must have a registered user. The exploit will extract a password hash from the forum's data base of the target user. You need to know the target user's member ID...
CVE-2005-4775
Michael Scholz and Sebastian Stein Contineo 2.0, when the admin account lacks an e-mail address attribute, displays the password hash in a warning upon page reload, which might allow remote attackers to view the hash...
CVE-2005-4775
CVE-2005-4775 affects Contineo 2.0; when the admin account lacks an e-mail attribute, a warning upon page reload displays the password hash. This could let remote attackers view the hash. No remediation details are provided in the supplied documents.