CVE-2007-6163

SQL injection vulnerability in admin/index2.asp in GOUAE DWD Realty allows remote attackers to execute arbitrary SQL commands via the pword aka Password parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-6163

CVE-2007-6163: Concrete details across connected sources show a SQL injection vulnerability in admin/index2.asp of GOUAE DWD Realty. The pword (Password) parameter is exploitable to execute arbitrary SQL commands, enabling remote attackers to interact with the database. Related entries also note ...

CVE-2007-6169

SQL injection vulnerability in admin/index2.asp in GOUAE DWD Realty allows remote attackers to execute arbitrary SQL commands via the uname parameter, a different vector than CVE-2007-6163. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-6169

CVE-2007-6169 concerns a SQL injection in admin/index2.asp of GOUAE DWD Realty. The vulnerable parameter is uname (distinct from CVE-2007-6163’s pword); exploitation would allow remote attackers to execute arbitrary SQL commands. The connected sources confirm a similar vulnerability in the same a...

GOUAE DWD Realty - 'Password' SQL Injection

source: https://www.securityfocus.com/bid/26579/info DWD Realty is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...

GOUAE DWD Realty - Password SQL Injection

GOUAE DWD Realty - Password SQL Injection source: https://www.securityfocus.com/bid/26579/info DWD Realty is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

Unfixed XSS vulnerability at www.landryrealty.com

Security researcher Norehem, has submitted on 09/08/2007 a cross-site-scripting XSS vulnerability affecting www.landryrealty.com, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/08/2007. It is current...

Open redirect

index.php in Open-Realty 2.3.4 allows remote attackers to obtain sensitive information the full path via an invalid listingID parameter in a listingview action...

CVE-2007-0490

index.php in Open-Realty 2.3.4 allows remote attackers to obtain sensitive information the full path via an invalid listingID parameter in a listingview action...

CVE-2007-0490

Open-Realty 2.3.4 is affected by CVE-2007-0490 where index.php via listingview with an invalid listingID exposes the full server path. This is an information-disclosure vulnerability that can be exploited remotely to obtain sensitive filesystem paths. Root cause is not detailed in the provided do...

CVE-2007-0490

index.php in Open-Realty 2.3.4 allows remote attackers to obtain sensitive information the full path via an invalid listingID parameter in a listingview action...

Full Path Disclosure in Open-Realty ( v2.3.4 )

Hello Vulnerable : Open-Realty Verision : 2.3.4 Web : http://www.open-realty.org Exploit : http://www.example.com/script/index.php?action=listingview&listingID='anything' -------------------- Discoverey By LinuxDrox www.LeZr.Com/vb Best Regards ,,,,...

CVE-2006-6342

Multiple SQL injection vulnerabilities in KLF-DESIGN aka Kim L. Fraser KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 agent parameters in a searchlisting.asp, and the 3 propertyid parameter in b detail.asp...

CVE-2006-6342

CVE-2006-6342 affects KLF-DESIGN/KLF-REALTY. The flaw allows remote SQL injection via parameters (category, agent) in search_listing.asp and (property_id) in detail.asp, enabling arbitrary SQL execution as described in the NVD entry. No explicit remediation or affected version details are provide...

CVE-2006-6342

Multiple SQL injection vulnerabilities in KLF-DESIGN aka Kim L. Fraser KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 agent parameters in a searchlisting.asp, and the 3 propertyid parameter in b detail.asp...

klf-realty [injection sql]

vendor site:http://klf-design.com/ product :klf-realty bug:injection sql risk : medium injection sql : /searchlisting.asp?category='sql /detail.asp?propertyid='sql /searchlisting.asp?agent='sql laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: [email protected]...

klfrealty.txt

vendor site:http://klf-design.com/ product :klf-realty bug:injection sql risk : medium injection sql : /searchlisting.asp?category='sql /detail.asp?propertyid='sql /searchlisting.asp?agent='sql laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: [email protected]...

Klf-Realty 2.0 - search_listing.asp Multiple SQL Injections

Klf-Realty 2.0 - searchlisting.asp Multiple SQL Injections source: https://www.securityfocus.com/bid/21199/info Klf-Realty is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could...

Klf-Realty 2.0 - 'search_listing.asp' Multiple SQL Injections

source: https://www.securityfocus.com/bid/21199/info Klf-Realty is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or...

CVE-2006-5840

Multiple SQL injection vulnerabilities in Abarcar Realty Portal allow remote attackers to execute arbitrary SQL commands via the 1 neid parameter to newsdetails.php, or the 2 slid parameter to slistl.php. NOTE: the cat vector is already covered by CVE-2006-2853. NOTE: the vendor has notified CVE...