1914 matches found
PHP-Nuke SQL注入及绕过SQL注入防护漏洞
PHP-Nuke是一个广为流行的网站创建和管理工具，它可以使用很多数据库软件作为后端，比如MySQL、PostgreSQL、mSQL、Interbase、Sybase等。 PHP-Nuke用于过滤POST输入的代码中存在SQL注入漏洞： == mainfile.php 143-146 ========================== ... if striposclone$postString,'%20union%20' OR \ striposclone$postString,'/union/' OR striposclone$postString,' union ' OR ...
PHPNuke-7.9.txt
------=Part21582213092688.1161562994664 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline / -------------------------------------------------------- Neo Security Team NST - Advisory 27 - 2006-10-22...
PHP-Nuke <= 7.9 (Encyclopedia) Remote SQL Injection Exploit
? / Neo Security Team - Exploit made by Paisterist on 2006-10-22 http://www.neosecurityteam.net / $host="localhost"; $path="/phpnuke/"; $prefix="nuke"; $port="80"; $fp = fsockopen$host, $port, $errno, $errstr, 30; $data="query=fooaa&eid=foo'//UNION SELECT pwd as title FROM $prefixauthors WHERE...
PHP-Nuke 7.9 - 'Encyclopedia' SQL Injection
? / Neo Security Team - Exploit made by Paisterist on 2006-10-22 http://www.neosecurityteam.net / $host="localhost"; $path="/phpnuke/"; $prefix="nuke"; $port="80"; $fp = fsockopen$host, $port, $errno, $errstr, 30; $data="query=fooaa&eid=foo'//UNION SELECT pwd as title FROM $prefixauthors WHERE...
PHP-Nuke <= 7.9 (Encyclopedia) Remote SQL Injection Exploit
Exploit for unknown platform in category web applications =========================================================== PHP-Nuke = 7.9 Encyclopedia Remote SQL Injection Exploit =========================================================== ? / Neo Security Team - Exploit made by Paisterist on 2006-10-...
PHP-Nuke <= 7.9 (Encyclopedia) Remote SQL Injection Exploit
No description provided by source. ? / Neo Security Team - Exploit made by Paisterist on 2006-10-22 http://www.neosecurityteam.net / $host="localhost"; $path="/phpnuke/"; $prefix="nuke"; $port="80"; $fp = fsockopen$host, $port, $errno, $errstr, 30; $data="query=fooaa&eid=foo'//UNION SELECT pwd as...
PHP-Nuke 7.9 - Encyclopedia SQL Injection
PHP-Nuke 7.9 - Encyclopedia SQL Injection ? / Neo Security Team - Exploit made by Paisterist on 2006-10-22 http://www.neosecurityteam.net / $host="localhost"; $path="/phpnuke/"; $prefix="nuke"; $port="80"; $fp = fsockopen$host, $port, $errno, $errstr, 30; $data="query=fooaa&eid=foo'//UNION SELECT...
PHP-Nuke Book Catalog Module 1.0 - 'upload.php' Arbitrary File Upload
source: https://www.securityfocus.com/bid/19890/info The Book Catalog module for PHP-Nuke is prone to a vulnerability that lets attackers upload arbitrary files. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible...
PHP-Nuke Book Catalog Module 1.0 - upload.php Arbitrary File Upload
PHP-Nuke Book Catalog Module 1.0 - upload.php Arbitrary File Upload source: https://www.securityfocus.com/bid/19890/info The Book Catalog module for PHP-Nuke is prone to a vulnerability that lets attackers upload arbitrary files. Exploiting this issue may allow an attacker to compromise the...
CVE-2006-4563
Cross-site scripting XSS vulnerability in the MyHeadlines before 4.3.2 module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the myhop parameter to modules.php...
CVE-2006-4563
CVE-2006-4563 details a cross-site scripting (XSS) flaw in the MyHeadlines before 4.3.2 module for PHP-Nuke. The vulnerability can be exploited remotely to inject arbitrary web script or HTML via the myh_op parameter to modules.php. Per the NVD entry, the CVSSv2 base score is 6.8 (MEDIUM) with ne...
CVE-2006-4563
Cross-site scripting XSS vulnerability in the MyHeadlines before 4.3.2 module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the myhop parameter to modules.php...
CVE-2006-4563: Undefined Security Weakness
Cross-site scripting XSS vulnerability in the MyHeadlines before 4.3.2 module for PHP-Nuke allows remote attackers to inject arbitrary web script or HTML via the myhop parameter to modules.php...
PHP-Nuke MyHeadlines 4.3.1 Module - Cross-Site Scripting
source: https://www.securityfocus.com/bid/19825/info PHP-Nuke MyHeadlines module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in the browser of an...
PHP-Nuke MyHeadlines 4.3.1 Module - Cross-Site Scripting
PHP-Nuke MyHeadlines 4.3.1 Module - Cross-Site Scripting source: https://www.securityfocus.com/bid/19825/info PHP-Nuke MyHeadlines module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to...
[SA21653] PHP-Nuke MyHeadlines Module "myh_op" Cross-Site Scripting
TITLE: PHP-Nuke MyHeadlines Module "myhop" Cross-Site Scripting SECUNIA ADVISORY ID: SA21653 VERIFY ADVISORY: http://secunia.com/advisories/21653/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: MyHeadlines 4.x module for PHP-Nuke http://secunia.com/product/11722...
phpnukeInclude.txt
local file include in PHP-Nuke autohtml.php Rish : High Class : Local Script : autohtml.php Thanks : www.lezr.com/vb & All kuwait hackers Link : http://www.lezr.com/vb/showthread.php?p=104324 Drkiz : allinurl:"autohtml.php" autohtml.php?op=modload&name=The-file-you-want-to-include Exampel :...
CVE-2006-4190
Directory traversal vulnerability in autohtml.php in the AutoHTML module for PHP-Nuke allows local users to include arbitrary files via a .. dot dot in the name parameter for a modload operation...
CVE-2006-4190
CVE-2006-4190 is a directory traversal vulnerability in the AutoHTML module for PHP-Nuke, exploitable via a .. in the name parameter of a modload operation within autohtml.php. The affected component is the AutoHTML module’s autohtml.php; root cause is improper handling of the filename parameter ...
CVE-2006-4190
Directory traversal vulnerability in autohtml.php in the AutoHTML module for PHP-Nuke allows local users to include arbitrary files via a .. dot dot in the name parameter for a modload operation...