[Full-Disclosure] TWiki search function allows arbitrary shell command execution

VULNERABLE SOFTWARE VERSIONS TWiki http://twiki.org/ - TWiki 20030201 e.g. Debian Sarge - probably later versions - Subversion repository at http://ntwiki.ethermage.net:8181/svn/twiki/trunk at least until revision 3224 including ATTACK VECTORS HTTP GET requests towards the Wiki server typically...

TWiki Search Function Arbitrary Command Execution

This module exploits a vulnerability in the search component of TWiki. By passing a 'search' parameter containing shell metacharacters to a 'Search' script, an attacker can execute arbitrary OS commands. Affected versions: - 20040901 - 20030201 - 20011201 - 20001201 - SVN up to and including...

XSS in & path disclosure phpBB forums

Affected versions: Dunno All? Code: http://www.phpbb.com/phpBB/search.php?searchid=3D1'scriptalert/guiler= minator20overload,20vampirun20mugroson/;/script Overview The error is like: ---------------- Could not obtain search results DEBUG MODE SQL Error : 1064 You have an error in your SQL syntax...

XSS bug in PHPNuke 6.0

Vulnerable systems: PHPNuke 6.0 & mabey all Exploit: 1- go to http://traget/modules.php?name=Downloads&dop=search 2- put in form search this code : Scriptjavascript:alertdocument.cookie/Script 3- click "Search" without "" you can't use it an URL like this http://traget/modules.php?...

L-Forum Vulnerability - SQL Injection

I have discovered an SQL injection flaw in L-Forum which has a recent record upload spoofing/XSS by Ulf of security bugs. The problem this time is search.php. It doesn't properly escape the SQL data passed in by the user in the search member. I have provided a SourceForge patch for this...