PHP-Fusion Module Arcade 1.0 - cid SQL Injection

PHP-Fusion Module Arcade 1.0 - cid SQL Injection -------------------------------- PHP-FUSION Arcade Module cid Remote SQL Injection Vuln -------------------------------- Bulan: xoron xoron.biz -------------------------------- Exploit:...

phpfusion2-sql.txt

!/usr/bin/perl -w PHP-Fusion 'CalendarPanel' Module showevent.PHP mmonth SQL Injection Exploit And PoC Type : SQL Injection Release Date : 2007-03-31 Product : http://php-fusion.co.uk/ Bug : http://localhost/script/modules/articles/print.php?id=x AND 1=1 or 1=0 PoC :...

PHP-Fusion Module Arcade 1.0 - 'cid' SQL Injection

-------------------------------- PHP-FUSION Arcade Module cid Remote SQL Injection Vuln -------------------------------- Bulan: xoron xoron.biz -------------------------------- Exploit: index.php?op=viewgamelist&cid=-1//union//select//null,username,userpassword,null,null,null//from//fusionusers/...

PHP-Fusion Module topliste 1.0 - 'cid' SQL Injection

-------------------------------- PHP-FUSION topliste Module cid Remote SQL Injection Vuln -------------------------------- Bulan: xoron - unique xoron.biz -------------------------------- Exploit:...

PHP-Fusion 6.1.5 Mod Calendar_Panel - Show_Event.php SQL Injection

PHP-Fusion 6.1.5 Mod CalendarPanel - ShowEvent.php SQL Injection source: https://www.securityfocus.com/bid/23225/info PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could all...

PHP-Fusion 6.1.5 Mod Calendar_Panel - 'Show_Event.php' SQL Injection

source: https://www.securityfocus.com/bid/23225/info PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

extreme-fusion <= 4.02 Remote Code Execution Exploit

No description provided by source. ? print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :+: :+: :+: :+: :+: :+: :+: +:+ +:+ +:+ +:+ +:+ +:+ +:+ ++ +:+ +++:++ ++ +:+ ++ ++ ++ ++ ++ ++ ++ ++ ++ + + + +++ + + ::::::::::: :::::::::: ::: :::: :::: :+: :+: :+: :+: +:+:+: :+:+:+ +:+ +:+ +:+ +:+ +:+...

eXtreme-fusion 4.02 - 'Fusion_Forum_View.php' Local File Inclusion

source: https://www.securityfocus.com/bid/21621/info eXtreme-fusion is prone to a local file-include vulnerability because the application fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute local scripts. By combining thi...

PHP-Fusion news.PHP SQL注入漏洞

PHP-Fusion是一款基于PHP的内容管理程序。 PHP-Fusion不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'news.PHP'脚本对用户提交的'SERVERREMOTEADDR'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 PHP-Fusion PHPFusion 6.1.4 PHP-Fusion PHP-Fusion 6.0.307 PHP-Fusion PHP-Fusion 6.0.204 PHP-Fusion PHP-Fusion 6.0.110 PHP-Fusion...

PHP-Fusion Maincore.PHP SQL注入漏洞

PHP-Fusion是一款基于PHP的内容管理程序。 PHP-Fusion不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Maincore.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 PHP-Fusion PHPFusion 6.1.4 PHP-Fusion PHP-Fusion 6.0.307 PHP-Fusion PHP-Fusion 6.0.204 PHP-Fusion PHP-Fusion 6.0.110 PHP-Fusion PHP-Fusion...

CVE-2006-4673

Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the SERVERREMOTEADDR parameter to news.php...

CVE-2006-4673

Global variable overwrite vulnerability in maincore.php in PHP-Fusion 6.01.4 and earlier uses the extract function on the superglobals, which allows remote attackers to conduct SQL injection attacks via the SERVERREMOTEADDR parameter to news.php...

CVE-2006-4673

The CVE-2006-4673 entry concerns PHP-Fusion 6.01.4 and earlier, where maincore.php applies extract() to superglobals. This enables a global-variable overwriting flaw that can lead to SQL injection via the _SERVER[REMOTE_ADDR] parameter to news.php. The vulnerability arises from unrestricted varia...

PHP-Fusion extract() Global Variable Overwriting

The version of PHP-Fusion on the remote host supports registering variables from user-supplied input in the event that PHP's 'registerglobals' setting is disabled, which is the default in current versions of PHP. Unfortunately, the way that this has been implemented in the version on the remote...

PHP-Fusion 6.0.x - news.php SQL Injection

PHP-Fusion 6.0.x - news.php SQL Injection source: https://www.securityfocus.com/bid/19908/info PHP-Fusion is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker...

PHP-Fusion 6.0.x - 'news.php' SQL Injection

source: https://www.securityfocus.com/bid/19908/info PHP-Fusion is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...

CVE-2006-3555

Multiple cross-site scripting XSS vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using editprofile.php to upload a 1 avatar or 2 forum image attachment that has a .gif or .jpg extension, and begins with a GIF header...

CVE-2006-3555

PHP-Fusion submit.php (before version 6.01.3) is vulnerable to multiple XSS flaws. An attacker can abuse edit_profile.php to upload an avatar or forum image (GIF/JPG) that starts with a GIF header followed by JavaScript, which is then executed by Internet Explorer. Affected component: submit.php ...

CVE-2006-3555

Multiple cross-site scripting XSS vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using editprofile.php to upload a 1 avatar or 2 forum image attachment that has a .gif or .jpg extension, and begins with a GIF header...

Php-Fusion (Xss) With Avatar Upload

Hi; ================== http://php-fusion.co.uk/ ================== Php-Fusion Xss With Avatar Upload... With This Vulnerability, You Are able To Become Any User Who Uses a Browser That "internet Explorer"Support Cross Site Scripting, So it is Possible To Become Admin. Firefox Can't Write.. Admin ...