CVE-2006-6421

CVE-2006-6421 is an XSS in phpBB 2.0.x; the private messaging (privmsg.php) feature allows remote authenticated users to inject arbitrary script/HTML via the Message body when targeting a non-existent user. Affected component: phpBB 2.0.x private messaging; root cause is user-supplied input not s...

CVE-2006-6421

Cross-site scripting XSS vulnerability in the private message box implementation privmsg.php in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user...

AdamIsmayPrintTopicModSQL注入漏洞

Adam Ismay Print Topic Mod是打印标题模块，可适合于phpBB等系统。Adam Ismay Print Topic Mod printview.php脚本不正确处理用户提交的恶意输入，远程攻击者可以利用这个漏洞获得敏感信息或更改系统数据库。Topic Mod printview.php脚本对用户提交给'ordersql'参数的数据缺少充分过滤，提交包含恶意数据可能更改原有数据库逻辑，修改数据库或获得敏感信息。 Adam Ismay Print Topic Mod 1.0 临时解决方法：如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：...

phpBB多个跨站脚本执行漏洞

phpBB是一款由PHP编写的WEB论坛应用程序，支持多种数据库系统，可使用在多种Unix和Linux操作系统下。phpBB多个脚本对用户提交URI输入缺少充分过滤，远程攻击者可以利用这个漏洞进行跨站脚本攻击，可能获得敏感信息。phpBB包含的'index.php'和'faq.php'脚本不正确过滤用户提交的URI输入，提交包含恶意脚本代码的数据作为参数，当其他用户浏览时，可导致基于验证的敏感信息泄露。 phpBB Group phpBB 2.0.8-2.0.8a 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：phpBB Group Upgrade...

phpBBHTTP应答分割攻击及跨站脚本执行漏洞

phpBB是一款由PHP编写的WEB论坛应用程序，支持多种数据库系统，可使用在多种Unix和Linux操作系统下。phpBB的多个脚本存在HTTP应答分割攻击或者跨站脚本攻击，远程攻击者可以利用这个漏洞进行WEB缓冲毒药，劫持也7面，或者敏感信息等攻击。如下两个脚本存在HTTP应答分割攻击：- /phpBB2/privmsg.php 'mode' 参数- /phpBB2/login.php 'redirect'...

PhpBB Toplist 1.3.7 Xss Vuln.

LiderHack.Org script name : PhpBB Toplist 1.3.7 Dork : toplist.php?f=toplistnew Risk : High Found By : St@rExT Vulnerable file : Toplist.php New add sites addres: toplist.php?f=toplistnew Name: xss code & Information: xss code & Name: h1Your name/h1 & Name: scriptalert"yourmessage"/script example...

phpbb 2.0.x [xss]

vendor site:http://phpbb.com/ product:phpbb bug:xss risk:low A xss post has been discovered in phpbb ,the impact of this attack is very low ,because it's more a bug , than a vulnerability . An authentificated user can excute some html code in his private message box , by sending a message to an...

AdamIsmayPrintTopicModSQL注入漏洞 Exploit

No description provided by source. Bartek Nowotarski （[email protected]）提供了如下测试方法：...

phpBB多个跨站脚本执行漏洞 Exploit

No description provided by source. Janek Vind （[email protected]）提供了如下测试方法： B1 - XSS in "index.php": http://localhost/phpbb208/index.php?categoryrows0catid=1 &categoryrows0cattitle=waraxescriptalertdocument.cookie;/script &categoryrows0catorder=99 B2 - XSS in "language\langenglish\langfaq.php...

phpBBHTTP应答分割攻击及跨站脚本执行漏洞 Exploit

No description provided by source. Ory Segal （[email protected]）提供了如下测试方法： 跨站脚本攻击： http://SERVER/phpBB2/search.php?searchauthor='scriptalertdocument.cookie/script HTTP应答分割 REQUEST POST /phpBB2/login.php HTTP/1.0 Host: SERVER User-Agent: Mozilla/4.7 en WinNT; I Accept-Encoding: gzip...

CVE-2006-6216

CVE-2006-6216 describes an SQL injection in admin_hacks_list.php within the Nivisec Hacks List 1.21 and earlier phpBB module. The vulnerability permits remote attackers to execute arbitrary SQL commands via the hack_id parameter. Affected software/component: Nivisec Hacks List (PHPBB module) vers...

CVE-2006-6216

SQL injection vulnerability in adminhackslist.php in the Nivisec Hacks List 1.21 and earlier phpBB module allows remote attackers to execute arbitrary SQL commands via the hackid parameter...

Admin Hacks List v1.20 Remote SQL Injection Vulnerability

Admin Hacks List v1.20 Remote SQL Injection Vulnerability Download: http://www.nivisec.com Found By: the master exploit:...

Hacks List phpBB Mod <= 1.21 Remote SQL Injection Vulnerability

No description provided by source. Admin Hacks List v1.20 Remote SQL Injection Vulnerability Download: http://www.nivisec.com Found By: the master exploit:...

Hacks List phpBB Mod 1.21 - SQL Injection

Hacks List phpBB Mod 1.21 - SQL Injection Admin Hacks List v1.20 Remote SQL Injection Vulnerability Download: http://www.nivisec.com Found By: the master exploit:...

Hacks List phpBB Mod <= 1.21 Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications =============================================================== Hacks List phpBB Mod = 1.21 Remote SQL Injection Vulnerability =============================================================== Admin Hacks List v1.20 Remote SQL Injection...

Hacks List phpBB Mod 1.21 - SQL Injection

Admin Hacks List v1.20 Remote SQL Injection Vulnerability Download: http://www.nivisec.com Found By: the master exploit:...

PhpBB Module Dimension Remote File Include

=============================================================================== =Bug was found in the part of phpBB = =Dork : "Powered by Dimension" = =Expl : includes/functions.php?phpbbrootpath= = =Source Code : http://www.xs4all.nl/hkicken/plusxl20/phpbb2plusxl20272.zip = =Found by : Rendy &...

PhpBB Module Dimension Remote File Include

=============================================================================== =Bug was found in the part of phpBB = =Dork : "Powered by Dimension" = =Expl : includes/functions.php?phpbbrootpath= = =Source Code : http://www.xs4all.nl/hkicken/plusxl20/phpbb2plusxl20272.zip = =Found by : Rendy &...

All Topics phpBB模块SQL注入漏洞

All Topics是phpBB中的一个模块，允许用户在一个页面中显示所有的主题，或选择论坛主题。 远程攻击者可以利用All Topics模块中的SQL注入漏洞在论坛中执行任意代码。 Peter Nijssen All Topics 1.5 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.phpbbhacks.com/download/2821 http://www.example.com/alltopics.php?mode=order=ASCstart=malicious SQL...