589 matches found
CVE-2008-1591: Improper Neutralization of Special Elements used in an SQL Command
The pnVarPrepForStore function in PostNuke 0.764 and earlier skips input sanitization when magicquotesruntime is enabled, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via input associated with server variables, as demonstrated by the CLIENTIP...
PostNuke pnVarPrepForStore()函数SQL注入漏洞
BUGTRAQ ID: 28407 PostNuke是一款开放源码、开放开发的内容管理系统（CMS）。 PostNuke的pnVarPrepForStore函数中存在SQL盲注漏洞，远程攻击者可能利用此漏洞非授权操作数据库。 以下是有漏洞部分的代码： 1. function pnVarPrepForStore 2. 3. $resarray = array; 4. foreach funcgetargs as $ourvar 5. if !getmagicquotesruntime && !isarray$ourvar 6. $ourvar = addslashes$ourvar; 7...
PostNuke <= 0.764 Blind SQL Injection Exploit
No description provided by source. !/usr/bin/python ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ ...
PostNuke 0.764 - Blind SQL Injection
PostNuke 0.764 - Blind SQL Injection !/usr/bin/python ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / =================================================================================================...
PostNuke <= 0.764 Blind SQL Injection Exploit
Exploit for unknown platform in category web applications ============================================= PostNuke | |||| /| / / ================================================================================================= This was a priv8 Exploit...
PostNuke 0.764 - Blind SQL Injection
!/usr/bin/python ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / ================================================================================================= This was a priv8 Exploit...
Debian Security Advisory DSA 879-1 (gallery)
The remote host is missing an update to gallery announced via advisory DSA 879-1. A bug in gallery has been discoverd that grants all registrated postnuke users full access to the gallery. The old stable distribution woody is not affected by this problem. OpenVAS Vulnerability Test $Id:...
Debian: Security Advisory (DSA-879-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2004-2751
SQL injection vulnerability in the memberslist module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter...
CVE-2004-2751
PostNuke 0.726 (and possibly earlier) contains an SQL injection in the members_list module, exploitable via the sortby parameter. This allows remote attackers to craft SQL commands to affect the database. The vulnerability is stated for the members_list component, with no additional exploit detai...
CVE-2003-1537
Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php...
CVE-2004-2752
PostNuke’s Downloads module (≤0.726) is affected by a cross-site scripting (XSS) flaw in the viewdownloaddetails action, triggered via the ttitle parameter. This allows remote injection of arbitrary HTML/JavaScript. The description is corroborated across CVE/NVD/Red Hat records; one connected EUV...
CVE-2004-2752
Cross-site scripting XSS vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later versions, allows remote attackers to inject arbitrary HTML and web script via the ttitle parameter in a viewdownloaddetails action...
CVE-2003-1537
CVE-2003-1537 is a directory traversal vulnerability affecting PostNuke 0.723 and earlier. The issue allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php. Connected sources corroborate the vulnerability description across NVD/Red Hat CVE records ...
CVE-2004-2752: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later versions, allows remote attackers to inject arbitrary HTML and web script via the ttitle parameter in a viewdownloaddetails action...
CVE-2003-1537: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in PostNuke 0.723 and earlier allows remote attackers to include arbitrary files named theme.php via the theme parameter to index.php...
CVE-2004-2751: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the memberslist module in PostNuke 0.726, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the sortby parameter...
CVE-2007-3584
SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execute arbitrary SQL commands via the order parameter...
