GetMyOwnArcade Search.PHP SQL注入漏洞

GetMyOwnArcade是一款基于PHP的WEB应用程序。 GetMyOwnArcade不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是'Search.PHP'脚本对用户提交的'$query'参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息，或者操作数据库。 GetMyOwnArcade 目前没有解决方案提供： http://www.getmyownarcade.com/ GetMyOwnArcade search.php $query SQL-Injection Discovered By:...

Sql injection

SQL injection vulnerability in search.php in GetMyOwnArcade allows remote attackers to execute arbitrary SQL commands via the query parameter...

CVE-2007-4386

CVE-2007-4386 : A SQL injection exists in GetMyOwnArcade’s search.php, exploitable by remote attackers through the query parameter to execute arbitrary SQL commands. According to the sources, the vulnerability enables partial loss of confidentiality, integrity, and availability, with a network at...

GetMyOwnArcade (search.php query) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================================== GetMyOwnArcade search.php query Remote SQL Injection Vulnerability ==================================================================== GetMyOwnArcade search.php $query...

GetMyOwnArcade - search.php?query SQL Injection

GetMyOwnArcade - search.php?query SQL Injection GetMyOwnArcade search.php $query SQL-Injection Discovered By: RoXur777 August 11th 2007 Google-Dork: "Powered by GetMyOwnArcade" / $query is not being filtered before getting passed to a query. Therefore, we can inject SQL code into the SQL-Query...

Cross site scripting

Cross-site scripting XSS vulnerability in Search.php in DiMeMa CONTENTdm CDM allows remote attackers to inject arbitrary web script or HTML via a search, probably related to the CISOBOX1 parameter to results.php in CDM 4.2...

CVE-2007-4245

Cross-site scripting XSS vulnerability in Search.php in DiMeMa CONTENTdm CDM allows remote attackers to inject arbitrary web script or HTML via a search, probably related to the CISOBOX1 parameter to results.php in CDM 4.2...

CVE-2007-4102

Cross-site scripting XSS vulnerability in search.php for sBlog 0.7.3 Beta allows remote attackers to inject arbitrary HTML and web script via a leading '"/ sequence in the search string...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to inject arbitrary web script or HTML via 1 the catid parameter to search.php or the 2 typ parameter to register.php...

CVE-2007-4085

Multiple SQL injection vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to execute arbitrary SQL commands via the 1 queid parameter to forumanswer.php or 2 the catid parameter to search.php...

sblog073-xss.txt

sBlog 0.7.3 Beta XSS Vulnerabilitie Found by 0x90 www.0x90.com.ar msn & mail: [email protected] in blog http://host/blog/search.php use '"/ Welcome to the jungle!...

Unfixed XSS vulnerability at www.buzzcomix.net

Security researcher FiSh, has submitted on 25/07/2007 a cross-site-scripting XSS vulnerability affecting www.buzzcomix.net, which at the time of submission ranked 101463 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/08/2007. It is currentl...

pafiledb-sql.txt

Site: http://www.phparena.net/pafiledb Description: SQL injection categories in includes/search.php Code: $results = $db-GetArray"SELECT FROM ".$dbPrefix."files WHERE ".$searchin." AND filecatid IN ".implode',',$POST'categories'.""; Comment:"ouuch" SQL: UNION SELECT ALL...

paFileDB includes/search.php categories Parameter SQL Injection

Binary data 4136.prm...

paFileDB 3.6 (search.php) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================ paFileDB 3.6 search.php Remote SQL Injection Vulnerability ============================================================ Site: http://www.phparena.net/pafiledb Description: SQL...

paFileDB 3.6 - 'search.php' SQL Injection

Site: http://www.phparena.net/pafiledb Description: SQL injection categories in includes/search.php Code: $results = $db-GetArray"SELECT FROM ".$dbPrefix."files WHERE ".$searchin." AND filecatid IN ".implode',',$POST'categories'.""; Comment:"ouuch" SQL: UNION SELECT ALL...

paFileDB 3.6 - search.php SQL Injection

paFileDB 3.6 - search.php SQL Injection Site: http://www.phparena.net/pafiledb Description: SQL injection categories in includes/search.php Code: $results = $db-GetArray"SELECT FROM ".$dbPrefix."files WHERE ".$searchin." AND filecatid IN ".implode',',$POST'categories'.""; Comment:"ouuch" SQL: UNI...

Unfixed XSS vulnerability at www.transformersclassics.com

Security researcher Genocide, has submitted on 07/12/2007 a cross-site-scripting XSS vulnerability affecting www.transformersclassics.com, which at the time of submission ranked 608341 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/12/2007...

CVE-2007-3484

Cross-site scripting XSS vulnerability in search.php in Google Custom Search Engine allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this issue is disputed by the Google Security Team, who states that "Google does not provide the 'search.php' script...

CVE-2007-3484

CVE-2007-3484 describes an XSS vulnerability in Google Custom Search Engine, where the q parameter in the search functionality is susceptible to script injection. The affected component is the search flow of Google Custom Search Engine (claims reference to a non-existent search.php script; Google...