CVE-2007-5189

Multiple SQL injection vulnerabilities in mesadd.php in x-script GuestBook 1.3a, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 name, 2 email, 3 icq, and 4 website parameters...

mdpro1076-sql.txt

!/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage; if$url = m/^?:http://./ $url = $1;...

MDPro 1.0.76 Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl use strict; use IO::Socket; my $app = "MDPro 1.0.76"; my $type = "SQL Injection"; my $author = "undefined1"; my $settings = "magicquotesruntime = off, mysql = 4.1.0"; $| = 1; print ":: $app $type - by $author ::\n\n\n"; my $url = shift || usage;...

clansphere-sql.txt

Inclusion Hunter Team http://www.ihteam.net Clansphere 2007.4 Class: SQL Injection Found: 22/09/2007 Remote: Yes Site: http://www.clansphere.net/ Download: http://sourceforge.net/project/showfiles.php?groupid=95430 Vulnerable code: mods/banners/navlist.php...

shopscript-exec.txt

?php Shop-Script FREE = 2.0 Remote Command Execution Exploit by InATeam tested on versions 1.2 and 2.0 works regardless magicquotesgpc=on Greetz: eXp, Kuzya, cxim, Russian, ENFIX echo "--------------------------------------------------------\n"; echo "Shop-Script FREE = 2.0 Remote Command Executi...

advisory-mambo-akobook-en.txt

Mambo Component AkoBook " are not allowed but simple quotes can still be used. The following code in one of the vulnerable inputs would result in a XSS:...

wolioCMS SQL Injection

wolioCMS - SQL Injection and Bypass Administrator Login Vendor : http://www.buton.web.id/member.php?member=anon Download : http://www.buton.web.id/download/woliocms.zip Found By : k1tk4t - k1tk4t4tnewhack.org Location : Indonesia -- newhackdotorg @irc.dal.net Exploit ini berhasil jika...

akocomment SQL INJECTION (all version)

$query2 = "INSERT INTO akocomment SET parentid='$acparentid', contentid='$contentid', ip='$ip', name='$acname', title='$title', comment='$comment', date='$date', published='$acautopublish';"; there are two SQL injection. POC: INPUT TYPE='hidden' NAME='acitemid' value='9'INPUT TYPE='hidden'...

TotalCalendar <= 2.402 (view_event.php) Remote SQL Injection Vulns

No description provided by source. --==+================================================================================+==--br / --==+ TotalCalendar 2.402 SQL Injection Vulnerability +==--br /...

CVE-2007-3183

Multiple SQL injection vulnerabilities in Calendarix 0.7.20070307, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 month and 2 year parameters to calendar.php and the 3 search string to calsearch.php...

EUVD-2007-3119

content.php in WSPortal 1.0, when magicquotesgpc is disabled, allows remote attackers to obtain sensitive information via a "';" quote semicolon sequence in the page parameter, which reveals the installation path in the resulting forced SQL error message...

PHProjekt: Multiple vulnerabilities

Background PHProjekt is a project management and coordination tool written in PHP. Description Alexios Fakos from n.runs AG has discovered multiple vulnerabilities in PHProjekt, including the execution of arbitrary SQL commands using unknown vectors CVE-2007-1575, the execution of arbitrary PHP...

CVE-2007-3214

SQL injection vulnerability in style.php in e-Vision CMS 2.02 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the template parameter...

[waraxe-2007-SA#050] - Sql Injection in WordPress 2.1.3

waraxe-2007-SA050 - Sql Injection in WordPress 2.1.3 ==================================================================== Author: Janek Vind "waraxe" Date: 21. May 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-50.html Target software description: Vulnerable: WordPress 2.1.3...

WEBInsta FM 0.1.4 - 'login.php' absolute_path Remote File Inclusion

!/usr/bin/perl / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ INFO: Program Title WebInsta FM = 0.1.4 Remote File Inclusion Vulnerability Description This is a basic file manager written by WebInsta.com Vuln Code In...

WEBInsta FM 0.1.4 login.php absolute_path Remote File Inclusion Exploit

Exploit for unknown platform in category web applications ======================================================================= WEBInsta FM 0.1.4 login.php absolutepath Remote File Inclusion Exploit ======================================================================= !/usr/bin/perl / \ / \ |...

The United States Blizzard[World Of Warcraft] official program vulnerability-vulnerability warning-the black bar safety net

Battle.net clan management system using a MySQL backend, allowing users to easily upgrade and maintain the web site. System to achieve on exist input validation vulnerability, a remote attacker could use this vulnerability to executeSQL injectionattacks, unauthorized access to system administrati...

IceBB 1.0-rc5 Remote Create Admin Exploit

Exploit for unknown platform in category web applications ========================================= IceBB 1.0-rc5 Remote Create Admin Exploit ========================================= !/usr/bin/perl IceBB 1.0-rc5 Remote Create Admin Exploit 1. register a user 2. run this exploit with this usage :...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the checkcsrftoken function in lib/lib.inc.php in PHProjekt 5.2.0, when magicquotesgpc is disabled, allow remote attackers to perform unauthorized actions as an arbitrary user via the 1 Projects, 2 Contacts, 3 Helpdesk, 4 Notes, 5 Search...

CVE-2007-1638

Multiple cross-site request forgery CSRF vulnerabilities in the checkcsrftoken function in lib/lib.inc.php in PHProjekt 5.2.0, when magicquotesgpc is disabled, allow remote attackers to perform unauthorized actions as an arbitrary user via the 1 Projects, 2 Contacts, 3 Helpdesk, 4 Notes, 5 Search...