phpCOIN 1.2.2 - 'phpcoinsessid' SQL Injection / Remote Code Execution

this works with magicquotesgpc off usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:"When these five kinds of spy are all at work, none can discover the secret system. This is called "divine manipulation of the threads." It is the sovereign's most precious faculty."...

phpCOIN 1.2.2 - phpcoinsessid SQL Injection Remote Code Execution

phpCOIN 1.2.2 - phpcoinsessid SQL Injection Remote Code Execution this works with magicquotesgpc off usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:"When these five kinds of spy are all at work, none can discover the secret system. This is called "divine manipulation of the...

dc_phpcoin.txt

Dcrab 's Security Advisory Hsc Security Group http://www.hackerscenter.com/ dP Security http://digitalparadox.org/ Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah Severity: High Title: Multiple Sql injections in phpCo...

CVE-2005-1384

Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 search parameter to index.php, 2 phpcoinsessid parameter to login.php, 3 id, 4 dtopicid, or 5 dcatid to mod.php...

CVE-2005-1384

CVE-2005-1384 : The phpCoin project – version 1.2.2 or older – is affected by multiple SQL injection vulnerabilities. The issues arise from improper sanitization in user-supplied input and affect the following entry points/parameters: (1) search in index.php, (2) phpcoinsessid in login.php, (3) i...

CVE-2005-0670

Cross-site scripting XSS vulnerability in phpCOIN 1.2.0 through 1.2.1b allows remote attackers to inject arbitrary web script or HTML via 1 the new parameter to mod.php, 2 the w parameter to mod.php, 3 the e parameter to login.php, 4 the o parameter to login.php, and possibly other scripts...

CVE-2005-0933

Directory traversal vulnerability in auxpage.php for phpCOIN 1.2.1b and earlier allows remote attackers to read arbitrary files via the page parameter...

CVE-2005-0669

Multiple SQL injection vulnerabilities in mod.php for phpCOIN 1.2.0 through 1.2.1b allow remote attackers to execute arbitrary SQL commands via the 1 the faqid in the faq mod, 2 the id parameter in the pages mod, 3 the id parameter in the siteinfo module, 4 the topicid parameter in the articles...

CVE-2005-0947

Directory traversal vulnerability in auxpage.php in phpCoin 1.2.1b and earlier allows remote attackers to read and execute arbitrary files via a .. dot dot in the page parameter...

CVE-2005-1384

Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 search parameter to index.php, 2 phpcoinsessid parameter to login.php, 3 id, 4 dtopicid, or 5 dcatid to mod.php...

CVE-2005-0932

Multiple SQL injection vulnerabilities in phpCOIN 1.2.1b and earlier allow remote attackers to execute arbitrary SQL commands 1 via the search engine, 2 the username or email fields in the "forgotten password" feature, or 3 the domain name in a package order...

CVE-2005-1384: Undefined Security Weakness

Multiple SQL injection vulnerabilities in phpCoin 1.2.2 allow remote attackers to execute arbitrary SQL commands via the 1 search parameter to index.php, 2 phpcoinsessid parameter to login.php, 3 id, 4 dtopicid, or 5 dcatid to mod.php...

Multiple Sql injections in phpCoin v1.2.2 and below

Dcrab 's Security Advisory Hsc Security Group http://www.hackerscenter.com/ dP Security http://digitalparadox.org/ Get Dcrab's Services to audit your Web servers, scripts, networks, etc. Learn more at http://www.digitalparadox.org/services.ah Severity: High Title: Multiple Sql injections in phpCo...

phpCOIN <= 1.2.2 Multiple SQL Injection Vulnerabilities

The remote host is running phpCOIN version 1.2.2 or older. These versions suffer from several SQL injection vulnerabilities due to their failure to properly sanitize input to the 'search' parameter of the 'index.php' script, the 'phpcoinsessid' parameter of the 'login.php' script and the 'id',...

PHPCoin < 1.2.2 2005-12-13 Multiple Script SQL Injection (deprecated)

Binary data 2867.prm...

phpCOIN 1.2 - 'login.php?PHPcoinsessid' SQL Injection

source: https://www.securityfocus.com/bid/13433/info PHPCoin is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a...

phpCOIN 1.2 Pages Module - Multiple SQL Injections

source: https://www.securityfocus.com/bid/13433/info PHPCoin is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a...

phpCOIN 1.2 - login.php?PHPcoinsessid SQL Injection

phpCOIN 1.2 - login.php?PHPcoinsessid SQL Injection source: https://www.securityfocus.com/bid/13433/info PHPCoin is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL...

CVE-2005-0946

SQL injection vulnerability in phpCoin 1.2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the 1 term/keywords field on the search page, 2 username or 3 e-mail field on the forgot password page, or 4 domain name on the ordering new package page...

CVE-2005-0946

CVE-2005-0946 affects phpCOIN 1.2.1b and earlier, with SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. Affected input surfaces include the term/keywords field on search, username or e-mail on forgot password, and domain name on the new package ordering...