bwired (index.php newsID) Remote SQL Injection Vulnerability

No description provided by source. / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ Program Title bwired - Remote SQL Injection Note...

Expert Advisior - 'index.php?id' SQL Injection

--==+================================================================================+==-- --==+ Expert Advisior SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: N/A DORK: intitle:"Answer...

TBDev.NET DR - TakeProfEdit.php HTML Injection

TBDev.NET DR - TakeProfEdit.php HTML Injection source: https://www.securityfocus.com/bid/24923/info TBDev.NET DR is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting this issue may allow an attacker to execute HTML and script...

FlashBB Sendmsg.PHP远程文件包含漏洞

FlashBB是一款基于PHP的论坛程序。 FlashBB不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是'Sendmsg.PHP'脚本对用户提交的'phpbbrootpath'参数缺少过滤，指定远程服务器上的PHP文件作为包含对象，可导致以WEB进程权限执行任意命令。 TUFaT FlashBB 1.1.7 目前没有解决方案提供 http://www.sebug.net/show-exp-2121.html...

PHP Director Videos.PHP SQL注入漏洞

PHP Director是一款基于PHP的WEB应用程序。 PHP Director不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Videos.PHP'脚本对用户提交的'id'参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 PHPDirector 0.21 目前没有解决方案提供： http://www.phpdirector.co.uk/site/...

Fujitsu ServerView 4.50.8 - DBASCIIAccess Remote Command Execution

source: https://www.securityfocus.com/bid/24762/info Fujitsu ServerView is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied data. Attackers can exploit this issue to execute arbitrary commands with the privileges of the affected application...

avarcade-sql.txt

Web: AV Arcade 2.1b Site : www.avscripts.net Dork : "Powered By AV Arcade" Author: Kw3rLn tehlostbyteatYaHoOd0tCom Romanian Security Team Ethical Hacking - hTTp://RSTZONE.nET Description: SQL injection in $id of includes/viewpage.php Exploit:...

Pharmacy System Index.PHP SQL注入漏洞

Pharmacy System是一款基于PHP的WEB应用程序。 Pharmacy System不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'index.php'脚本对用户提交的WEB参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 NetArt Media Pharmacy System 2.0 目前没有解决方案提供： http://www.netartmedia.net/pharmacysystem/...

Comersus Cart 7.0.7 - comersus_optReviewReadExec.asp?id SQL Injection

Comersus Cart 7.0.7 - comersusoptReviewReadExec.asp?id SQL Injection source: https://www.securityfocus.com/bid/24562/info Comersus Cart is affected by multiple input validation vulnerabilities. A successful exploit could allow an attacker to compromise the application, access or modify data, or...

SpamAssassin本地符号链接和拒绝服务漏洞

SpamAssassin是一款功能强大的反垃圾邮件系统。 SpamAssassin存在符号链接和拒绝服务攻击问题，远程攻击者可以利用漏洞使应用程序崩溃，或提升特权。 目前没有详细漏洞细节提供。 SpamAssassin SpamAssassin 3.2 SpamAssassin SpamAssassin 3.1.9 SpamAssassin SpamAssassin 3.1.8 SpamAssassin SpamAssassin 3.1.7 SpamAssassin SpamAssassin 3.1.6 SpamAssassin SpamAssassin 3.1.5 SpamAssass...

Menu Manager Mod for WebAPP - No Input Filtering

There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 . System commands can be entered in user's personal menus. Any system command works there and allows reading ...

Kravchuk letter script 1.0 (scdir) Remote File Inclusion Vulnerabilities

No description provided by source. ++++++++++++++++++++++++++++++ ++++++++++++++++++++++++++++++++++++++ + K-letter 1.0 Remote File include + +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ + DownloadScript: http://www.scripts.com.ua/download.php?ID=813 +...

kas-sql.txt

Discovered by: kerem125 & gsy Website: http://www.kerem125.com/ & http://www.by-gsy.org/ Script download: http://download.asprehberi.net/dosyalar/kategoriler/alisveris/freepaypalshoppingcarttr.zip Exploit: /news.asp?newsid=16union+select+all+0,1,adminname,Password,4+from+admin Example :...

RevokeBB <= 1.0 RC4 Blind SQL Injection / Hash Retrieve Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo " ------------------------------------------------------------- RevokeBB = 1.0 RC4 Blind SQL Injection / Hash Retrieve Exploit Site: http://www.revokesoft.net by BlackHawk [email protected]...

Apple Mac OSX 10.4.9 - VPND Local Format String

Apple Mac OSX 10.4.9 - VPND Local Format String source: https://www.securityfocus.com/bid/24208/info Apple Mac OS X's VPN service daemon is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a...

Inout Search Engine (all version) Remote Code Execution Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo " Inout Search Engine all version Remote Code Execution Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love "; if $argc3 echo "Usage: php...

Zomplog <= 3.8 (mp3playlist.php speler) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/python ---------------------------------------------------------------------------------- The sql injection : /zomplog-3.8/plugins/mp3playlist/mp3playlist.php?speler=sql I've code a sploit for the fun x...

glossword-rfi.txt

GlossWord v1.8 u script deil ! -- http://glossword.info/ ! Site : http://sourceforge.net/projects/glossword/ Author : BeyazKurt - [email protected] kimse eyimde deil ! Download : http://sourceforge.net/projects/glossword/ includeonce$sys'pathaddon'.'/multilingualvars.php';...

PostNuke Module v4bJournal - SQL Injection

PostNuke Module v4bJournal - SQL Injection ---------------------------------------- PostNuke Journal ---------------------------------------- DISCOVERED BY :Ali Abbasi Olom Fonon Mazandaran University - Security Research Center, Babol, Iran Greetz For All Y! UnderGround Group Members www.2600.ir...

wavewoo 0.1.1 (loading.php path_include) Remote File Inclusion Exploit

No description provided by source. html head meta http-equiv="Content-Type" content="text/html; charset=windows-1254" titleAlessandro Lulli wavewoo Remote File Include Exploit/title script language="JavaScript"...