142 matches found
Simple PHP Blog 0.8.4 Cross Site Request Forgery
that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- inp...
Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin)
that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input typ...
Simple PHP Blog 0.5.1 - Local File Inclusion Vulnerability
No description provided by source. Simple PHP Blog is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context ...
Simple PHP Blog <= 0.4.0 - Multiple Remote Exploits
No description provided by source. !/usr/bin/perl -w =============================================================================== Title: sphpblogvulns.pl Written by: Kenneth F. Belva, CISSP Franklin Technologies Unlimited, Inc. http://www.ftusecurity.com Date: August 25, 2005 Version: 0.1...
Simple PHP Blog 0.4 colors.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/15283/info Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to hav...
Maran PHP Blog 'comments.php' Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/30309/info Maran PHP Blog is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of ...
Simple PHP Blog <= 0.4.7.1 - Remote Command Execution Exploit
No description provided by source. !/usr/bin/perl use IO::Socket; print Simple PHP Blog = 0.4.7.1 cmmnds xctn exploit\r\n; print through arbitrary local inclusion\r\n; print rgod [email protected]\r\n; print - this works with magicquotesgpc = Off\r\n\r\n; short explaination: we have this code in...
Simple PHP Blog 0.5.x 'search.php' Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/37752/info Simple PHP Blog is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in t...
Simple PHP Blog 0.4 preview_cgi.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/15283/info Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to hav...
Blog Mod <= 0.1.9 SQL Injection Vulnerability
Exploit for php platform in category web applications How does this exploit works? It exploits one of the several SQL Injections in the system. Specifiedly, in the file "index.php", parr "month". Usage: php filename.php / function puts$str echo $str."\n"; function gets return trimfgetsSTDIN;...
CVE-2011-5029
Multiple cross-site scripting XSS vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the 1 entry parameter to delete.php or 2 category parameter to index.php...
CVE-2011-5029
CVE-2011-5029 affects Simple PHP Blog, version 0.7.0 (and possibly earlier). The vulnerability is a cross-site scripting (XSS) flaw in which an attacker can inject arbitrary web script or HTML via the following parameters: (1) entry parameter to delete.php and (2) category parameter to index.php....
Ignition 1.3 Code Execution
?php / Ignition 1.3 Remote Code Execution Exploit by cOndemned download: http://launchpad.net/ignition/trunk/1.3/+download/ignition-1.3.tar.gz source of i-options.php 1. ?php 2. sessionstart; 3. if $POST'submit' 4. if $FH = @fopen'data/settings.php', 'w' 5. @fwrite$FH, '?php $pass =...
Ignition 1.3 - Remote Code Execution
?php / Ignition 1.3 Remote Code Execution Exploit by cOndemned download: http://launchpad.net/ignition/trunk/1.3/+download/ignition-1.3.tar.gz source of i-options.php 1. ?php 2. sessionstart; 3. if $POST'submit' 4. if $FH = @fopen'data/settings.php', 'w' 5. @fwrite$FH, '?php $pass =...
Simple PHP Blog 0.4.0 - Remote Command Execution (Metasploit)
$Id: sphpblogfileupload.rb 9929 2010-07-25 21:37:54Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
Simple PHP Blog v5.11 XSS Vulnerability
No description provided by source. Simple PHP Blog Cross Site Scripting Exploit Author: Sora Contact: vhr95zw at hotmail dot com Website: http://greyhathackers.wordpress.com/ Vulnerability Description: Simple PHP Blog suffers from a remote cross site scripting exploit in the parameter 'q' of...
Simple PHP Blog 5.11 Cross Site Scripting
------------------------------------ Simple PHP Blog Cross Site Scripting Exploit Author: Sora Contact: vhr95zw at hotmail dot com Website: http://greyhathackers.wordpress.com/ Vulnerability Description: Simple PHP Blog suffers from a remote cross site scripting exploit in the parameter 'q' of...
Simple PHP Blog 0.5.x - search.php Cross-Site Scripting
Simple PHP Blog 0.5.x - search.php Cross-Site Scripting source: https://www.securityfocus.com/bid/37752/info Simple PHP Blog is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...
Directory traversal
Directory traversal vulnerability in languagescgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the bloglanguage1 parameter...
CVE-2009-4421
Directory traversal vulnerability in languagescgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the bloglanguage1 parameter...