phpBB多个跨站脚本执行漏洞

phpBB是一款由PHP编写的WEB论坛应用程序，支持多种数据库系统，可使用在多种Unix和Linux操作系统下。phpBB多个脚本对用户提交URI输入缺少充分过滤，远程攻击者可以利用这个漏洞进行跨站脚本攻击，可能获得敏感信息。phpBB包含的'index.php'和'faq.php'脚本不正确过滤用户提交的URI输入，提交包含恶意脚本代码的数据作为参数，当其他用户浏览时，可导致基于验证的敏感信息泄露。 phpBB Group phpBB 2.0.8-2.0.8a 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：phpBB Group Upgrade...

phpBBHTTP应答分割攻击及跨站脚本执行漏洞

phpBB是一款由PHP编写的WEB论坛应用程序，支持多种数据库系统，可使用在多种Unix和Linux操作系统下。phpBB的多个脚本存在HTTP应答分割攻击或者跨站脚本攻击，远程攻击者可以利用这个漏洞进行WEB缓冲毒药，劫持也7面，或者敏感信息等攻击。如下两个脚本存在HTTP应答分割攻击：- /phpBB2/privmsg.php 'mode' 参数- /phpBB2/login.php 'redirect'...

CVE-2006-6421: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the private message box implementation privmsg.php in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user...

PhpBB Toplist 1.3.7 Xss Vuln.

LiderHack.Org script name : PhpBB Toplist 1.3.7 Dork : toplist.php?f=toplistnew Risk : High Found By : St@rExT Vulnerable file : Toplist.php New add sites addres: toplist.php?f=toplistnew Name: xss code & Information: xss code & Name: h1Your name/h1 & Name: scriptalert"yourmessage"/script example...

phpBBHTTP应答分割攻击及跨站脚本执行漏洞 Exploit

No description provided by source. Ory Segal （[email protected]）提供了如下测试方法： 跨站脚本攻击： http://SERVER/phpBB2/search.php?searchauthor='scriptalertdocument.cookie/script HTTP应答分割 REQUEST POST /phpBB2/login.php HTTP/1.0 Host: SERVER User-Agent: Mozilla/4.7 en WinNT; I Accept-Encoding: gzip...

AdamIsmayPrintTopicModSQL注入漏洞 Exploit

No description provided by source. Bartek Nowotarski （[email protected]）提供了如下测试方法：...

phpBB多个跨站脚本执行漏洞 Exploit

No description provided by source. Janek Vind （[email protected]）提供了如下测试方法： B1 - XSS in "index.php": http://localhost/phpbb208/index.php?categoryrows0catid=1 &categoryrows0cattitle=waraxescriptalertdocument.cookie;/script &categoryrows0catorder=99 B2 - XSS in "language\langenglish\langfaq.php...

phpbb 2.0.x [xss]

vendor site:http://phpbb.com/ product:phpbb bug:xss risk:low A xss post has been discovered in phpbb ,the impact of this attack is very low ,because it's more a bug , than a vulnerability . An authentificated user can excute some html code in his private message box , by sending a message to an...

CVE-2006-6216

SQL injection vulnerability in adminhackslist.php in the Nivisec Hacks List 1.21 and earlier phpBB module allows remote attackers to execute arbitrary SQL commands via the hackid parameter...

CVE-2006-6216

CVE-2006-6216 describes an SQL injection in admin_hacks_list.php within the Nivisec Hacks List 1.21 and earlier phpBB module. The vulnerability permits remote attackers to execute arbitrary SQL commands via the hack_id parameter. Affected software/component: Nivisec Hacks List (PHPBB module) vers...

CVE-2006-6216: Undefined Security Weakness

SQL injection vulnerability in adminhackslist.php in the Nivisec Hacks List 1.21 and earlier phpBB module allows remote attackers to execute arbitrary SQL commands via the hackid parameter...

Admin Hacks List v1.20 Remote SQL Injection Vulnerability

Admin Hacks List v1.20 Remote SQL Injection Vulnerability Download: http://www.nivisec.com Found By: the master exploit:...

Hacks List phpBB Mod <= 1.21 Remote SQL Injection Vulnerability

No description provided by source. Admin Hacks List v1.20 Remote SQL Injection Vulnerability Download: http://www.nivisec.com Found By: the master exploit:...

Hacks List phpBB Mod <= 1.21 Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications =============================================================== Hacks List phpBB Mod = 1.21 Remote SQL Injection Vulnerability =============================================================== Admin Hacks List v1.20 Remote SQL Injection...

Hacks List phpBB Mod 1.21 - SQL Injection

Hacks List phpBB Mod 1.21 - SQL Injection Admin Hacks List v1.20 Remote SQL Injection Vulnerability Download: http://www.nivisec.com Found By: the master exploit:...

Hacks List phpBB Mod 1.21 - SQL Injection

Admin Hacks List v1.20 Remote SQL Injection Vulnerability Download: http://www.nivisec.com Found By: the master exploit:...

PhpBB Module Dimension Remote File Include

=============================================================================== =Bug was found in the part of phpBB = =Dork : "Powered by Dimension" = =Expl : includes/functions.php?phpbbrootpath= = =Source Code : http://www.xs4all.nl/hkicken/plusxl20/phpbb2plusxl20272.zip = =Found by : Rendy &...

PhpBB Module Dimension Remote File Include

=============================================================================== =Bug was found in the part of phpBB = =Dork : "Powered by Dimension" = =Expl : includes/functions.php?phpbbrootpath= = =Source Code : http://www.xs4all.nl/hkicken/plusxl20/phpbb2plusxl20272.zip = =Found by : Rendy &...

All Topics phpBB模块SQL注入漏洞

All Topics是phpBB中的一个模块，允许用户在一个页面中显示所有的主题，或选择论坛主题。 远程攻击者可以利用All Topics模块中的SQL注入漏洞在论坛中执行任意代码。 Peter Nijssen All Topics 1.5 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpbbhacks.com/download/2821 http://www.example.com/alltopics.php?mode=order=ASCstart=malicious SQL...

phpBB XS bb_usage_stats.php远程文件包含漏洞

phpBB XS是一款基于PHP的论坛程序。 phpBB XS在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞在服务器上以Web进程权限执行任意命令。 phpBB XS的bbusagestats/includes/bbusagestats.php脚本没有正确验证phpbbrootpath参数的输入数据，允许攻击者通过包含本地或外部资源的任意文件导致执行任意代码。成功攻击要求打开了registerglobals。bbusagestats.php中漏洞代码如下： line 24 include$phpbbrootpath...