CVE-2008-3487: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in profile.php in PHPAuction GPL Enhanced 2.51 allows remote attackers to execute arbitrary SQL commands via the id parameter...

PHPAuction GPL Enhanced 'profile.php' SQL注入漏洞

BUGTRAQ ID: 30501 CNCAN ID：CNCAN-2008080426 PHPAuction GPL Enhanced是一款基于PHP的WEB应用程序。 PHPAuction GPL Enhanced不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'profile.php'脚本对用户提交给'id'参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 PHPAuctions.info PHPAuction GPL Enhanced 2.51 目前没有解决方案提供：...

phpAuction GPL Enhanced 2.51 - profile.php SQL Injection

phpAuction GPL Enhanced 2.51 - profile.php SQL Injection || | | PHPAuction GPL Enhanced V2.51 profile.php id Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : www.tryag.cc/cc | | email: darkangelg85atYahooDoTcom | | | | | ...

PHPAuction GPL Enhanced 2.51 (profile.php) SQL Injection Vulnerability

No description provided by source. || | | PHPAuction GPL Enhanced V2.51 profile.php id Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : www.tryag.cc/cc | | email: darkangelg85atYahooDoTcom | | | | | | | | script :...

phpauctiongpl-sql.txt

|| | | PHPAuction GPL Enhanced V2.51 profile.php id Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : www.tryag.cc/cc | | email: darkangelg85atYahooDoTcom | | | | | | | | script : http://phpauctions.info/ | | DorK : /: ||...

phpAuction GPL Enhanced 2.51 - 'profile.php' SQL Injection

|| | | PHPAuction GPL Enhanced V2.51 profile.php id Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : www.tryag.cc/cc | | email: darkangelg85atYahooDoTcom | | | | | | | | script : http://phpauctions.info/ | | DorK : /: ||...

PHPAuction GPL Enhanced 2.51 (profile.php) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ====================================================================== PHPAuction GPL Enhanced 2.51 profile.php SQL Injection Vulnerability ====================================================================== || | | PHPAuction GPL Enhanc...

Sql injection

SQL injection vulnerability in profile.php in AlstraSoft AskMe Pro 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: The queid parameter to forumanswer.php is already covered by CVE-2007-4085...

CVE-2008-2902: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in profile.php in AlstraSoft AskMe Pro 2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: The queid parameter to forumanswer.php is already covered by CVE-2007-4085...

PHPAuction (profile.php user_id) Remote SQL Injection Vulnerability

No description provided by source. Viva IslaM Viva IslaM Remote SQL Injection Vulnerability PHPAuction profile.php userid AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM & WwW.ATsDp.CoM Email : [email protected] !! SYRIAN HaCkErS !! Script : PHPAuction site : www.phpauctions.info D0rk1 : allinurl:...

phpAuction - 'profile.php' SQL Injection (2)

source: https://www.securityfocus.com/bid/29856/info PHPAuction is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

phpauction-sql.txt

Viva IslaM Viva IslaM Remote SQL Injection Vulnerability PHPAuction profile.php userid AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM & WwW.ATsDp.CoM Email : [email protected] !! SYRIAN HaCkErS !! Script : PHPAuction site : www.phpauctions.info D0rk1 : allinurl: "profile.php?userid" auctionid D0rk2 :...

phpAuction - profile.php SQL Injection (1)

phpAuction - profile.php SQL Injection 1 Viva IslaM Viva IslaM Remote SQL Injection Vulnerability PHPAuction profile.php userid AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM & WwW.ATsDp.CoM Email : [email protected] !! SYRIAN HaCkErS !! Script : PHPAuction site : www.phpauctions.info D0rk1 : allinurl:...

phpAuction - 'profile.php' SQL Injection (1)

Viva IslaM Viva IslaM Remote SQL Injection Vulnerability PHPAuction profile.php userid AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM & WwW.ATsDp.CoM Email : [email protected] !! SYRIAN HaCkErS !! Script : PHPAuction site : www.phpauctions.info D0rk1 : allinurl: "profile.php?userid" auctionid D0rk2 :...

PHPAuction (profile.php user_id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications =================================================================== PHPAuction profile.php userid Remote SQL Injection Vulnerability =================================================================== Viva IslaM Viva IslaM Remote SQL...

Sql injection

Multiple SQL injection vulnerabilities in Web Group Communication Center WGCC 1.0.3 PreRelease 1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 userid parameter to a profile.php in a "show moreinfo" action; the 2 bildid parameter to b picturegallery.php i...

CVE-2008-2446

CVE-2008-2446 affects Web Group Communication Center (WGCC) 1.0.3 PreRelease 1 and earlier. Multiple SQL injection vulnerabilities allow arbitrary SQL execution via parameters in several actions: (1) userid in profile.php (show moreinfo), (2) bildid in picturegallery.php (shownext), (3) id in fil...

CVE-2008-2446

Multiple SQL injection vulnerabilities in Web Group Communication Center WGCC 1.0.3 PreRelease 1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 userid parameter to a profile.php in a "show moreinfo" action; the 2 bildid parameter to b picturegallery.php i...

CVE-2008-2446: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Web Group Communication Center WGCC 1.0.3 PreRelease 1 and earlier allow remote authenticated users to execute arbitrary SQL commands via the 1 userid parameter to a profile.php in a "show moreinfo" action; the 2 bildid parameter to b picturegallery.php i...

CVE-2008-2445: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in profile.php in Web Group Communication Center WGCC 1.0.3 PreRelease 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the userid parameter in a show action...