cpg-sql.txt

toHex$sql . ', ' . $this-toHex'bazik' . ' LIMIT 1,1/'; $b1 = 'bazik'; $a2 = $sql; $b2 = 'bazik'; $arr = array$a1 = $b1, $a2 = $b2; return $this-GLOBALS'prefix' . 'albpw=' . rawurlencodeserialize$arr; function toHex$str for $i=0; $i GLOBALS'host', 80, $errno, $errstr, 30; if!$fp die"- Can't connec...

Debian Security Advisory DSA 771-1 (pdns)

The remote host is missing an update to pdns announced via advisory DSA 771-1. Several problems have been discovered in pdns, a versatile nameserver that can lead to a denial of service. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-2301 Norbert...

Pixelpost index.php parent_id Parameter SQL Injection

The remote host is running Pixelpost, a photo blog application based on PHP and MySQL. The version of Pixelpost installed on the remote host fails to sanitize input to the 'parentid' parameter of the 'index.php' script before using it to perform database queries. Provided PHP's 'magicquotesgpc'...

Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : postgresql vulnerabilities (USN-568-1)

Nico Leidecker discovered that PostgreSQL did not properly restrict dblink functions. An authenticated user could exploit this flaw to access arbitrary accounts and execute arbitrary SQL queries. CVE-2007-3278, CVE-2007-6601 It was discovered that the TCL regular expression parser used by...

X7 Chat index.php day Parameter SQL Injection

The remote host is running X7 Chat, a web-based chat program written in PHP. The version of X7 Chat installed on the remote host fails to sanitize input to the 'day' parameter of the 'index.php' script when 'page' is set to 'event' before using it in 'sources/infobox.php' to construct database...

Vulnerability in core server (CVE-2007-4769)

Three vulnearbilities in the regular expression handling libraries can be exploited to cause a backend crash, infinite loops or memory exhaustion. This vulnearbility can be exploited through frontend applications that allow unfiltered regular expressions to be passed in queries...

CVE-2007-6667

SQL injection vulnerability in faq.php in MyPHP Forum 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the member.php vector is already covered by CVE-2005-0413...

CVE-2003-1538: Improper Input Validation

susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, which allows remote attackers to execute arbitrary commands via CGI queries...

exoops-sql.txt

E-xoops multiple variable/scripts SQL injection vendor url: http://www.e-xoops.com Advisore: http://lostmon.blogspot.com/2007/12/ e-xoops-multiple-variablescripts-sql.html vendor notify:NO exploits available: YES E-xoops is content-community management system written in PHP-MySQL. E-xoops contain...

Firefly Media Server (mt-daapd) 2.4.1 / SVN 1699 Multiple Vulnerabilities

No description provided by source. Luigi Auriemma Application: Firefly Media Server mt-daapd http://www.fireflymediaserver.org Versions: = 2.4.1 and SVN = 1699 Platforms: nix, Windows, Mac and others...

kvaliitti-sql.txt

Found by: Jaakko "Chrysalid" Hartikainen 1. Info Kvaliitti WebDoc 3.0 CMS is a proprietary Finnish-made content management system developed by Kvaliitti Oy http://www.kvaliitti.fi. It is driven by MS SQL Server and ASP. 2. Abstract WebDoc 3.0 suffers from a flaw in input validation, which allows...

MySQL 5.1.13 - INFORMATION_SCHEMA Remote Denial of Service

MySQL 5.1.13 - INFORMATIONSCHEMA Remote Denial of Service source: https://www.securityfocus.com/bid/28351/info MySQL is prone to a remote denial-of-service vulnerability because it fails to handle certain specially crafted queries. An attacker can exploit this issue to crash the application,...

drupal -- SQL injection vulnerability

The Drupal Project reports: The function taxonomyselectnodes directly injects variables into SQL queries instead of using placeholders. While taxonomy module itself validates the input passed to taxonomyselectnodes, this is a weakness in Drupal core. Several contributed modules, such as...

Irola My-Time 3.5 Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================== Irola My-Time 3.5 Remote SQL Injection Vulnerability ==================================================== ----------------------------- Vendor: http://www.irola.com Username/Password...

Irola My-Time 3.5 - SQL Injection

Aria-Security Team http://Aria-Security.Net ----------------------------- Original Advisory @ http://aria-security.net/forum/showthread.php?p=1106 Vendor: http://www.irola.com Username/Password Fields can run SQL Queries. Therefore: We get the Tables: UserInfo.UserID UserInfo.Login...

[Full-disclosure] Predictable DNS transaction IDs in Microsoft DNS Server

1 Summary Affected software: Microsoft Windows 2003 SP2, Microsoft Windows 2000 SP4 Server Vendor URL: www.microsoft.com Severity: Medium References: Microsoft Security Bulletin MS07-062, CVE-2007-3898 2 Vulnerability Description Microsoft DNS server generates predictable DNS transaction IDs. If...

XOOPS 2.0.17.1 Mylinks Module - Brokenlink.php SQL Injection

XOOPS 2.0.17.1 Mylinks Module - Brokenlink.php SQL Injection source: https://www.securityfocus.com/bid/26392/info Xoops Mylinks module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this...

XOOPS 2.0.17.1 Mylinks Module - 'Brokenlink.php' SQL Injection

source: https://www.securityfocus.com/bid/26392/info Xoops Mylinks module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. Exploiting this vulnerability could permit remote attackers to pass maliciou...

Fedora 7 : php-pear-Structures-DataGrid-DataSource-MDB2-0.1.10-1.fc7 (2007-0847)

Security fix: users could manipulate the generated sorting queries Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

CVE-2007-4755

Alien Arena 2007 6.10 and earlier allows remote attackers to cause a denial of service client disconnect by sending a clientconnect command in a forged packet from the server to a client. NOTE: client IP addresses are available via product-specific queries...