Baran CMS 1.0 - Arbitrary .ASP File Upload File Disclosure SQL Injection Cross-Site Scripting Cookie Manipulation

Baran CMS 1.0 - Arbitrary .ASP File Upload File Disclosure SQL Injection Cross-Site Scripting Cookie Manipulation 0x01 Informations : Name : Baran Cms Version : 1.0 Personal site : http://www.baran-cms.ir $$ : 50$ Vul : Arbitrary ASP File Upload/DB/SQL/XSS/CM Credit : Aria-Security Team Website :...

Max CMS2. 0beta (maxcms)administrator authentication bypass vulnerability-vulnerability warning-the black bar safety net

by flyh4t http://bbs.wolvez.org/ maxcms background have auto upgrade function, the ajax that the injection is patched, but the vulnerability still not patched. In the previous patch with classmates to see if they can bypass the authentication, the answer is Yes, but the premise is to know the...

E-PHP Scripts EShop SQL Injection

E-Php Scripts Eshop 'searchresults.php' SQL Injection Vulnerability Dicovered By: SaiedHacker Group: HackeranShiraz Security Team Web Address: www.HackeranShiraz.Com E-mail: [email protected] Exploit:...

E-PHP Scripts B2B Trading Marketplace XSS

E-Php Scripts B2B Trading Marketplace XSS Vulnerability Dicovered By: SaiedHacker Group: HackeranShiraz Security Team Web Address: www.HackeranShiraz.Com E-mail: [email protected] Exploits: http://Target/b2b/signin.php?errmsg=%3Cscript%3Ealert1;%3C/script%3E...

NewsCMSlite Insecure Cookie Handling

www.BugReport.ir AmnPardaz Security Research Team Title: NewsCMSlite Vendor: http://www.katywhitton.com Bug: Insecure Cookie Handling Exploitation: Remote with browser Fix: N/A Original Advisory: http://www.bugreport.ir/index62.htm - Description: NewsCMSlite is an easy way to get regularly update...

PHP-List Remote Code Execution

phplist 2.10.x remote code execution Credit:AmnPardaz Security Research Team for the vuln exploit author [email protected] Poc root@server pentest perl phplistrce.pl http://www.helpcenter.it/list/ phplist 2.10.x 0day RCE may b others by mozi: uname -a 686 i686 i386 GNU/Linux mozi: w 04:43:41 up...

E-PHP CMS SQL Injection

E-PHP cms SQL Injection Vulnerability Dicovered By: SaiedHacker Group: HackeranShiraz Security Team Web Address: www.HackeranShiraz.Com E-mail: [email protected] Creator: http://ephpscripts.com Demo Exploit:...

Oracle Containers For Java Traversal

Server Version Info: Oracle-Application-Server-10g/10.1.3.1.0 Oracle-HTTP-Server PoC: http://OC4J/web-app/foobar/%c0%ae%c0%ae/WEB-INF/web.xml Related: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2938 Explaination: The "%c0%ae%c0%ae" is interpreted as: ".." because on Java's side:...

GNUBoard 4.31.03 (08.12.29) - Local File Inclusion

GNUBoard V4.31.03 08.12.29 Local/Remote File Include Vulnerability BY flyh4thotmail.com Thx to qiuren/rayt TEAM:Wolves Security Team SITE:http://bbs.wolvez.org/ / SIR GNUBoard VERSION 4.31.03 08.12.29is a widely used bulletin board system of Korea. It is freely available for all platforms that...

GNUBoard 4.31.03 (08.12.29) - Local File Inclusion

GNUBoard 4.31.03 08.12.29 - Local File Inclusion GNUBoard V4.31.03 08.12.29 Local/Remote File Include Vulnerability BY flyh4thotmail.com Thx to qiuren/rayt TEAM:Wolves Security Team SITE:http://bbs.wolvez.org/ / SIR GNUBoard VERSION 4.31.03 08.12.29is a widely used bulletin board system of Korea...

GNUBoard 4.31.03 (08.12.29) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ============================================================== GNUBoard 4.31.03 08.12.29 Local File Inclusion Vulnerability ============================================================== GNUBoard V4.31.03 08.12.29 Local/Remote File Include...

FreeBSD-SA-09:04.bind

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-09:04.bind Security Advisory The FreeBSD Project Topic: BIND DNSSEC incorrect checks for malformed signatures Category: contrib Module: bind Announced: 2009-01-13...

Joomla! Component com_xevidmegahd - SQL Injection

!/usr/bin/perl -w Joomla comxevidmegahd Sql injection Author : EcHoLL www.warezturk.org www.tahribat.com Greetz : Blacklabel TURK Godlike Nitrous ! ModuleName: comxevidmegahd ! ScriptName: Joomla ! GoogleDork: inurl:"comxevidmegahd" system"color FF0000"; system"Nohacking"; print...

Joomla com_xevidmegahd (catid) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications =========================================================== Joomla comxevidmegahd catid Remote SQL Injection Exploit =========================================================== !/usr/bin/perl -w Joomla comxevidmegahd Sql injection Author :...

RHEL 4 / 5 : openssl (RHSA-2009:0004)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2009:0004 advisory. OpenSSL is a toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength,...

SA-CONTRIB-2009-001 - Project release - Multiple vulnerabilities

Exploitable from: Remote Vulnerabilities: Arbitrary file upload, Cross-site scripting XSS The Project release module is a component within the broader Project module. This announcement covers the following two issues: 1. Project release enables file attachments to create a specific version of cod...

Vulnerability in OpenSSL CVE-2008-5077

The Google Security Team discovered several functions inside OpenSSL incorrectly checked the result after calling the EVPVerifyFinal function, allowing a malformed signature to be treated as a good signature rather than as an error. This issue affected the signature checks on DSA and ECDSA keys...

Joomla Phoca Documentation Component SQL Injection Exploit

!/usr/bin/perl -w Joomla comphocadocumentation Sql injection Author : EcHoLL www.warezturk.org www.tahribat.com Greetz : Blacklabel TURK Godlike Nitrous ! ModuleName: comphocadocumentation ! ScriptName: Joomla ! GoogleDork: inurl:"comphocadocumentation" system"color FF0000"; system"Nohacking";...

SolucionWeb SQL Injection

IRANIAN THE BEST HACKERS IN THE WORLD Remote SQL injection Vulnerability SolucionWeb main.php?idarea AuTh0r : EhsanHp200 H0ME : www.only-4dl.tk Email : [email protected] Vendor : http://www.solucionweb.com/ Persian Gulf 4 Ever! Dork : "Powered by SolucionWeb" "inurl:main.php?idarea=" Exploit...

Joomla! Component com_na_newsdescription - newsid SQL Injection

Joomla! Component comnanewsdescription - newsid SQL Injection !/usr/bin/perl -w Joomla comnanewsdescription Sql injection Author : EcHoLL www.warezturk.org www.tahribat.com Greetz : Blacklabel TURK Godlike Nitrous ! ModuleName: comnanewsdescription ! ScriptName: Joomla ! GoogleDork:...