em.txt

Aria-Security Team Advisory Original Advisory : http://aria-security.net/advisory/Engine Manager.txt ----------------------------------------------------------- Software: Engine Manager Method: SQL Injection PoC: http://target/pathindex.asp?mid=SQL Injection Contact: [email protected]...

Sql injection in Tikiwiki

Hi, There are 2 sql injections in Tikiwiki 1.9.4 and maybe before versions : I There is a call to "getprocess" function in "tiki-g-adminprocesses.php" file, without checking "pid" parameter : File /tiki-g-adminprocesses.php, Line 35 : :: $info = $processManager-getprocess$REQUEST"pid"; Lets take ...

Plume CMS 1.1.3 (dbinstall.php) Remote File Include Vulnerability

Exploit for unknown platform in category web applications ================================================================= Plume CMS 1.1.3 dbinstall.php Remote File Include Vulnerability =================================================================...

phpMySms 2.0 - ROOT_PATH Remote File Inclusion

phpMySms 2.0 - ROOTPATH Remote File Inclusion PhpMySms = V2.0 ROOTPATH Remote File Include Vulnerability URL : Http://www.phpmysms.com Author=Persian-Defacer www.Hacking-Boys.com ============================================================== if $POSTmode == "1" or $GETmode == "1" include...

I-RATER Platinum - Config_settings.TPL.php Remote File Inclusion

I-RATER Platinum - Configsettings.TPL.php Remote File Inclusion source: https://www.securityfocus.com/bid/17731/info I-RATER Platinum is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploi...

Farsinews Cross-Site Scripting & Path disclosure vulnerability

Farsinews Cross-Site Scripting & Path disclosure vulnerability ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' Aria-Security.net Advisory Discovered by:R@1D3N amin emami [email protected] Gr33t to:A.u.r.a & O.u.t.l.a.w & Smok3...

CuteNews 1.4.1 - function.php Local File Inclusion

CuteNews 1.4.1 - function.php Local File Inclusion CuteNews 1.4.1 user Hash password Finder CuteNews 1.4.1 and Below user Hash password Finder Security ? . Bug Discovered and Exploited by Hamid Ebadi .: Hamid Network Security Team :. Happy Norouz PERSIAN new year celebration Greetz to all Iranian...

CuteNews <= 1.4.1 (function.php) Local File Include Exploit

Exploit for unknown platform in category web applications =========================================================== CuteNews CuteNews 1.4.1 user Hash password Finder CuteNews 1.4.1 and Below user Hash password Finder Security ? . Bug Discovered and Exploited by Hamid Ebadi .: Hamid Network...

d2kBlog 1.0.3 (memName) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl -w D2KBLOG SQL injection Discovered by : Farhad Koosha farhadkey at kapda.ir Exploited by : devilbox devilbox at kapda.ir member of : Kapda.ir - Security Science Researchers Institute of Iran persianhacker.net require LWP::UserAgent; require...

foojanInject.txt

Vendor : http://foojan.soltoononline.com A complete Persian PHP Weblog WMS Example Information Disclosure: http://target/foojan/adminmodules/daylinks/index.php http://target/foojan/index.php?daylinkspage=-1 Refferer Html Injection Where : in gmain.php $Weblog- query "INSERT INTO visits id , ip ,...