waraxe-2007-SA052.txt

waraxe-2007-SA052 - dBlog CMS Open Source database retrieval ==================================================================== Author: Janek Vind "waraxe" Date: 19. September 2007 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-52.html Target software description:...

KwsPHP 1.0 Member_Space Module - SQL Injection

!/usr/bin/perl use LWP::UserAgent; use HTTP::Cookies; $host = $ARGV0; $User = $ARGV1; $passwd = $ARGV2; $url = "http://".$host; $port = "80"; print q Script....................: KwsPHP v1.0 MemberSpace Module Script Site...............: http://kws.koogar.org/ Vulnerability.............: Remote SQ...

Wordpress Multiple Versions Pwnpress Exploitation Tookit

No description provided by source. !/usr/bin/env ruby .---. .---. : : o : happy antiblogging, dear kids! ..-: 0 : :-.. / .-'' ' ---' ---' " -. Copyright c Lance M. Havok .' " ' " . " . ' " . lmh at info-pull.com : '.---.,,.,...,.,.,.,..---. ' ; . " . .' " .' ----- All rights reserved. &nbsp...

wordpress -- remote sql injection vulnerability

Alexander Concha reports: While testing WordPress, it has been discovered a SQL Injection vulnerability that allows an attacker to retrieve remotely any user credentials from a vulnerable site, this bug is caused because of early database escaping and the lack of validation in query string like...

[SECURITY] Fedora 7 Update: fetchmail-6.3.7-2.fc7

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

[SECURITY] Fedora Core 6 Update: fetchmail-6.3.6-3.fc6

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

OpenSSL cryptographic vulnerability

Montgomery multiplication for elleptic cryptography is not applied in BNfrommontgomery functions, making it possible to retrieve RSA private key of different user...

Prozilla Webring Website Script - category.php?cat SQL Injection

Prozilla Webring Website Script - category.php?cat SQL Injection --==+================================================================================+==-- --== Prozilla Webring Website Script SQL Injection Vulnerbility +==--...

finger NSE Script

Attempts to retrieve a list of usernames using the finger service. Example Usage nmap -sV -sC Script Output PORT STATE SERVICE 79/tcp open finger | finger: | Welcome to Linux version 2.6.31.12-0.2-default at linux-pb94.site ! | 01:14am up 18:54, 4 users, load average: 0.14, 0.08, 0.01 | | Login...

phpnukesearch-xss.txt

PHP-Nuke ALL versions Search Module multiple XSS and HTML injection ------------------------------------------------------------------- The well-known PHP-Nuke CMS is vulnerable to multiple XSS attacks and HTML injections through the Search Module. The request is made using POST, but the whole...

People Directory search can be misused to retrieve email addresses of all users

Even when email addresses should be hidden because of global settings, it is possible to retrieve email addresses of all the users in the system by misusing search in people directory. It seems that the email address is one of the attributes that are being indexed by the search engine. So if one...

[Full-disclosure] [Sec-1 Ltd] Advisory: MailMarshal Spam Quarantine Password Retrieval Vulnerability

SEC-1 LTD. www.sec-1.com Security Advisory Advisory Name: MailMarshal Spam Quarantine Password Retrieval Vulnerability Release Date: 17-06-2007 Application: MailMarshal SMTP 6.2.0.x Platform: Microsoft Windows Severity: Password Retrieval Author: Gary O'leary-Steele Reported: See time line sectio...

MailMarshal Spam Quarantine Interface Arbitrary Account Password Retrieval

The remote host is running the Spam Quarantine Management web component of MailMarshal SMTP, a mail server for Windows. The version of the Spam Quarantine Management web component installed on the remote host fails to sanitize input to the 'emailTextBox' parameter of the 'Register.aspx' script...

Realtor 747 - index.php?categoryId SQL Injection

Realtor 747 - index.php?categoryId SQL Injection --==+================================================================================+==-- --==+ Realtor 747 SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZ...

Prozilla Directory Script - 'Directory.php?cat_id' SQL Injection

--==+================================================================================+==-- --==+ Prozilla Directory Script SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

vBulletin Mod RPG Inferno 2.4 - 'inferno.php' SQL Injection

--==+================================================================================+==-- --==+ RPG Inferno v2.4 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

[Full-disclosure] POWER PHLOGGER v.2.2.5 (username) SQL Injection

POWER PHLOGGER v.2.2.5 username SQL Injection Author: Attila Gerendi Darkz Date: June 25, 2007 Package: POWER PHLOGGER http://www.phpee.com/ Versions Affected: v.2.2.5 Other versions may also be affected Severity: SQL Injection Description: Input passed to the "username" parameter in "login.php"...

phpEventCalendar 0.2.3 - eventdisplay.php SQL Injection

phpEventCalendar 0.2.3 - eventdisplay.php SQL Injection !/usr/bin/perl Vendor url: www.ikemcg.com require LWP::UserAgent; print " phpEventCalendar ; if$target ! /^http:/// $target = "http://".$target; if$target ! //$/ $target .= "/"; print "User id to retrieve name/password from? 1 = admin";...

easybe-sql.txt

--==+================================================================================+==-- --==+ Easybe 1-2-3 Music Store SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

myserver-disclose.txt

The vulnerability is caused due to a parser error of the filename extension supplied by the user in the URL. This can be exploited to retrieve the source code of script files. Found By:Shay Priel aka Prili site: http://www.myserverproject.net/ poc: ---- http://localhost/cgi-bin/post.mscgI I -...