391 matches found
Session fixation
Session fixation vulnerability in DataLife Engine DLE 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie...
CVE-2013-7387
CVE-2013-7387 affects DataLife Engine (DLE) 9.7 and earlier . The vulnerability is a session fixation flaw allowing remote attackers to hijack web sessions via the PHPSESSID cookie. The connected documents specify the affected product/version and the attack vector but do not provide concrete reme...
CVE-2013-7387
Session fixation vulnerability in DataLife Engine DLE 9.7 and earlier allows remote attackers to hijack web sessions via the PHPSESSID cookie...
AlienVault OSSIM SQL注入以及远程代码执行
这个模块利用一个未授权SQL注入漏洞，影响AlienVault OSSIM 4.3.1以下版本。这个SQL注入漏洞可以用来找回一个活动的admin session ID，如果一个管理员级别的用户被认证了，payload中一个action可以创建一个高授权策略来执行任意代码。 0 4.3.1以及更低的版本 更新为最新的AlienVault OSSIM This module requires Metasploit: http//metasploit.com/download Current source:...
AlienVault OSSIM SQL Injection / Code Execution
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "AlienVault OSSIM SQL Injection and Remote Code Execution", 'Description' = %q This module exploits an unauthenticated SQL injection...
AlienVault OSSIM SQL Injection and Remote Code Execution
This module exploits an unauthenticated SQL injection vulnerability affecting AlienVault OSSIM versions 4.3.1 and lower. The SQL injection issue can be abused in order to retrieve an active admin session ID. If an administrator level user is identified, remote code execution can be gained by...
CVE-2014-2341
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
Session fixation
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2014-2341
Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter...
CVE-2014-2341
CubeCart prior to version 5.2.9 is vulnerable to a session-fixation flaw where an attacker can hijack a user session via the PHPSESSID parameter. The vulnerability stems from inadequate session protection (the only guard referenced is the User-Agent header in 5.2.8); PoCs show manipulating the PH...
Localize: Information Disclosure (Directory Structure)
The /var/www/ directory structure is exposed if you add "" to the PHPSESSID in the cookie. Request: GET / HTTP/1.1 Host: www.localize.io Accept: / Accept-Language: en User-Agent: Mozilla/5.0 compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0 Connection: close Referer:...
CubeCart 5.2.8 - Session Fixation
Exploit for php platform in category web applications Exploit Title: CubeCart 5.2.8 Session Fixation Exploit Author: James Sibley absane Blog: http://www.pentester.co Download link: http://www.cubecart.com/download/5.2.8/zip Discovery date: March 14th, 2014 Vendor notified: March 15th, 2014 Vendo...
CubeCart 5.2.8 - Session Fixation
CubeCart 5.2.8 - Session Fixation Exploit Title: CubeCart 5.2.8 Session Fixation Exploit Author: James Sibley absane Blog: http://www.pentester.co Download link: http://www.cubecart.com/download/5.2.8/zip Discovery date: March 14th, 2014 Vendor notified: March 15th, 2014 Vendor fixed: April 10th,...
CubeCart 5.2.8 - Session Fixation
Exploit Title: CubeCart 5.2.8 Session Fixation Exploit Author: James Sibley absane Blog: http://www.pentester.co Download link: http://www.cubecart.com/download/5.2.8/zip Discovery date: March 14th, 2014 Vendor notified: March 15th, 2014 Vendor fixed: April 10th, 2014 Vendor ack:...
UAG-CMS Session Fixation
Exploit Title: UAG-CMS Session Fixation Script Date: 2014 18 March Author: Dr.3v1l Vendor Homepage: http://julienetnel.github.io/inu/ Tested on: Windows Category: webapps Google Dork: intext:"UAG CMS" + Exploit : http:///UAG-CMS/admin/identification.php Discovered by: Scripting...
ChatNess 2.5 Session Fixation
Exploit Title: ChatNess 2.5 Session Fixation Script Date: 2014 18 March Author: Dr.3v1l Vendor Homepage: http://www.chatness.us Version : 2.5 Tested on: Windows Category: webapps Google Dork: intext:"Powered by Chatness" + Exploit : http:///chatness/chatness/chat.php Discovered by: Scripting...
ZPanel 10.0.0.2 htpasswd Module Username Command Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "ZPanel 10.0.0.2...
Design/Logic Flaw
PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID...
CVE-2012-4674
PluXml before 5.1.6 is vulnerable: remote attackers can obtain the installation path via the PHPSESSID. Root cause is improper handling of PHPSESSID leading to path disclosure. Affected software: PluXml (versions prior to 5.1.6). Impact stated: potential information disclosure of installation pat...
