autohtml-lfi.txt

-------------------------------------------------------------------------------------------------------------------------------------- Another Bug on PHP-Nuke autohtml.php AutoHTML Module Local File Inclusion Dork: inurl:autohtml.php?filename=LFI Example:...

PHP-Nuke NSN Script Depository源代码信息泄露漏洞

PHP-Nuke NSN Script Depository是一款基于PHP的WEB应用程序。 PHP-Nuke NSN Script Depository不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞获得源代码信息。 问题是由于脚本对用户提交的'file'参数缺少过滤，提交脚本文件作为参数数据，可导致获得目标脚本的源代码信息。 NukeScripts NSN Script Depository 1.0 目前没有解决方案提供：...

PHP-Nuke NSN Script Depository 1.0.0 Remote Source Disclosure Vuln

No description provided by source. --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / / &nb...

PHP-Nuke NSN Script Depository 1.0.0 Remote Source Disclosure Vuln

Exploit for unknown platform in category web applications ================================================================== PHP-Nuke NSN Script Depository 1.0.0 Remote Source Disclosure Vuln ==================================================================...

PHP-Nuke NSN Script Depository 1.0.0 - Remote Source Disclosure

PHP-Nuke NSN Script Depository 1.0.0 - Remote Source Disclosure --------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg...

Re: PHP-Nuke NSN Script Depository module <= 1.0.3 Remote Source / DB Credentials Disclosure

sorry, i've made a mistake! only the versions = 1.0.0 are veulnerable!...

phpnukensn-disclose.txt

--------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg --------------------------------------------------------------- PHP-Nuke...

PHP-Nuke NSN Script Depository module <= 1.0.3 Remote Source / DB Credentials Disclosure

--------------------------------------------------------------- / | | / | / |/ | | |/ | | / | | | | | |/ | | // | || | ||| /| / / | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg...

PHP-Nuke NSN Script Depository 1.0.0 - Remote Source Disclosure

--------------------------------------------------------------- / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / --------------------------------------------------------------- Http://www.inj3ct-it.org Staffatinj3ct-itdotorg --------------------------------------------------------------- PHP-Nuke...

Exploits PHP-Nuke Module Advertising Blind SQL Injection

No description provided by source. !/usr/bin/perl Product: PHP-Nuke Module Advertising BugFounder: 0x90 HomePage: WwW.0x90.COM.Ar Problem: Blind SQL Injection use strict; use warnings; use LWP; use Time::HiRes; use IO::Socket; my $host = "http://url/modules.php?name=Advertising"; my $useragent =...

PHP-Nuke Advertising Module Modules.PHP SQL注入漏洞

PHP-Nuke Advertising Module是一款基于PHP的WEB应用程序。 PHP-Nuke Advertising Module不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'Modules.PHP'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或可能操作数据库。 PHP-Nuke Advertising Module 0.9 升级到最新的PHP-Nuke Advertising Module 0.9...

Another vulnerability in PHP-Nuke captcha

Здравствуйте 3APA3A! Сообщаю вам о найденной мною другой Insufficient Anti-automation уязвимости в капче PHP-Nuke. Данная капча уязвима для Null string bypass method. Insufficient Anti-automation: Эксплоит: http://websecurity.com.ua/uploads/2007/MoBiC/PHP-Nuke20CAPTCHA20bypass3.html Уязвима верси...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. PHP-Nuke: CAPTCHA protection bypass. Peter’s Random Anti-Spam Image: CAPTACHA protection bypass and crossite scripting...

phpnukema-sql.txt

!/usr/bin/perl Product: PHP-Nuke Module Advertising BugFounder: 0x90 HomePage: WwW.0x90.COM.Ar Problem: Blind SQL Injection use strict; use warnings; use LWP; use Time::HiRes; use IO::Socket; my $host = "http://url/modules.php?name=Advertising"; my $useragent = LWP::UserAgent-new; my $metodo =...

PHP-Nuke Advertising Module 0.9 - modules.php SQL Injection

PHP-Nuke Advertising Module 0.9 - modules.php SQL Injection source: https://www.securityfocus.com/bid/26406/info The PHP-Nuke Advertising Module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. PHP-Nuke: CAPTCHA protection bypass...

Vulnerability in PHP-Nuke captcha

Здравствуйте 3APA3A! Сообщаю вам о найденной мною Insufficient Anti-automation уязвимости в капче PHP-Nuke. Данная капча уязвима для MustLive CAPTCHA bypass method. Insufficient Anti-automation: Эксплоиты: http://websecurity.com.ua/uploads/2007/MoBiC/PHP-Nuke20CAPTCHA20bypass.html...

PHP-Nuke Module Advertising Blind SQL Injection

!/usr/bin/perl Product: PHP-Nuke Module Advertising BugFounder: 0x90 HomePage: WwW.0x90.COM.Ar Problem: Blind SQL Injection use strict; use warnings; use LWP; use Time::HiRes; use IO::Socket; my $host = "http://url/modules.php?name=Advertising"; my $useragent = LWP::UserAgent-new; my $metodo =...

PHP-Nuke Advertising Module 0.9 - 'modules.php' SQL Injection

source: https://www.securityfocus.com/bid/26406/info The PHP-Nuke Advertising Module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in edit.php in the MS TopSites add-on for PHP-Nuke does not verify that the uname parameter matches the current account, which allows remote authenticated users to change arbitrary accounts or change the SiteTitleName field as an arbitrary user via a...