Sql injection

SQL injection vulnerability in includes/functions/banners-external.php in phpBP 2 RC3 2.204 FIX 4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a bannerout action...

phpbp-sql.txt

.-----------------------------------------------------------------------------. | vuln.: phpBP HACKBOX.pl query"SELECT FROM $confprefixbanners WHERE id=$GETid" or $db-errFILE, LINE; 13 14 if$db-numrows==0 15 16 redirect'index.php?module=error?error=bannerserror2'; 17 exit; 18 19 20...

phpBP <= RC3 (2.204) FIX4 Remote SQL Injection Vulnerability

No description provided by source. .-----------------------------------------------------------------------------. | vuln.: phpBP = RC3 2.204 FIX4 Remote SQL Injection Vulnerability | | download: http://www.phpbp.com/ | | dork: "PHP BP Team" | | &nbsp...

phpBP RC3 (2.204) FIX4 - SQL Injection

phpBP RC3 2.204 FIX4 - SQL Injection .-----------------------------------------------------------------------------. | vuln.: phpBP HACKBOX.pl query"SELECT FROM $confprefixbanners WHERE id=$GETid" or $db-errFILE, LINE; 13 14 if$db-numrows==0 15 16...

phpBP <= RC3 (2.204) FIX4 Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================ phpBP HACKBOX.pl query"SELECT FROM $confprefixbanners WHERE id=$GETid" or $db-errFILE, LINE; 13 14 if$db-numrows==0 15 16 redirect'index.php?module=error?error=bannerserror2'; 17...

phpBP RC3 (2.204) FIX4 - SQL Injection

.-----------------------------------------------------------------------------. | vuln.: phpBP HACKBOX.pl query"SELECT FROM $confprefixbanners WHERE id=$GETid" or $db-errFILE, LINE; 13 14 if$db-numrows==0 15 16 redirect'index.php?module=error?error=bannerserror2'; 17 exit; 18 19 20...

MyBB多个远程PHP代码执行漏洞

BUGTRAQ ID: 27322 CNCAN ID:CNCAN-2008011706 MyBB是一款基于PHP的WEB应用程序。 MyBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意代码. 问题是由于'forumdisplay.php'和'search.php'脚本对用户提交的'fid'参数处理缺少充分过滤，提交恶意数据，在获得"sid"的情况下，可导致任意代码执行。 MyBulletinBoard MyBulletinBoard 1.2.10 MyBulletinBoard MyBulletinBoard 1.2.5 MyBulletinBoard...

Joomla! Component Content 1.5 RC3 - view SQL Injection

Joomla! Component Content 1.5 RC3 - view SQL Injection source: https://www.securityfocus.com/bid/26707/info Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow ...

AlsaPlayer 0.99.x - Vorbis Input Plugin OGG Processing Remote Buffer Overflow

source: https://www.securityfocus.com/bid/25969/info AlsaPlayer is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer. Exploiting this issue allows attackers to execute arbitrary machine...

Cross site scripting

Cross-site scripting XSS vulnerability in catalogproductswithimages.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Remote file inclusion

PHP remote file inclusion vulnerability in inc/articles.inc.php in phpMyPortal 3.0.0 RC3 allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALSCHEMINMODULES parameter...

CVE-2007-2594

CVE-2007-2594 describes a remote file inclusion in phpMyPortal 3.0.0 RC3, specifically in inc/articles.inc.php, where the attacker can supply a URL via the GLOBALS[CHEMINMODULES] parameter to execute arbitrary PHP code. This allows remote code execution on the affected system. The vulnerability’s...

phpMyPortal 3.0.0 RC3 GLOBALS[CHEMINMODULES] RFI Exploit

Exploit for unknown platform in category web applications ======================================================== phpMyPortal 3.0.0 RC3 GLOBALSCHEMINMODULES RFI Exploit ======================================================== phpMyPortal 3.0.0 RC3GLOBALSCHEMINMODULESRemote File Include Exploit...

phpMyPortal 3.0.0 RC3 - GLOBALS[CHEMINMODULES] Remote File Inclusion

phpMyPortal 3.0.0 RC3GLOBALSCHEMINMODULESRemote File Include Exploit //'=============================================================================================== //'Script Name: phpMyPortal 22 acc.s Version 3.0.0 RC3 du 05/05/2007 //'Ex :...

CVE-2007-2383

CVE-2007-2383 affects the Prototype.js framework prior to 1.5.1 RC3, which exposes JSON data via a SCRIPT SRC URL and allows data exfiltration via JavaScript Hijacking. Public connected documents confirm the vulnerability vector and mention the affected library version. The provided sources do no...

PT-2007-3716 · Prototype · Prototypejs

Name of the Vulnerable Software and Affected Versions: prototypejs versions prior to 1.5.1 RC3 Description: The issue allows remote attackers to obtain data via a web page that retrieves the data through a URL in the SRC attribute of a SCRIPT element and captures the data using other JavaScript...

WebCreator <= 0.2.6-rc3 (moddir) Remote File Inclusion Vulnerability

No description provided by source. \ /\ / | \ | / // / | | \ \ Y / | / / \ /\| /\ / / / / / .OR.ID ECHOADV74$2007 ------------------------------------------------------------------------------------- ECHOADV74$2007 WebCreator = 0.2.6-rc3 moddir Remote File Inclusion Vulnerability...

CVE-2007-1459

CVE-2007-1459 affects WebCreator 0.2.6-rc3 and earlier, enabling PHP remote file inclusion via the moddir parameter to content/load.inc.php, config/load.inc.php, http/load.inc.php, and other files. The underlying issue allows remote attackers to execute arbitrary PHP code on affected installation...

CVE-2007-0695

Multiple SQL injection vulnerabilities in Free LAN Intra|ternet Portal FLIP before 1.0-RC3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some sources mention the escapesqlData, implodesql, and implodesqlIn functions, but these are protection schemes, not...

CVE-2007-0695

Multiple SQL injection vulnerabilities in Free LAN Intra|ternet Portal FLIP before 1.0-RC3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: some sources mention the escapesqlData, implodesql, and implodesqlIn functions, but these are protection schemes, not...