SQL injection in Serendipity

High-Tech Bridge SA Security Research Lab has discovered vulnerability in Serendipity, which can be exploited to perform SQL injection attacks. 1 SQL injection in Serendipity 1.1 Input passed via the "url" GET parameter to comment.php is not properly sanitised before being used in a SQL query. Th...

Serendipity CMS 1.6 Cross Site Scripting

Title: ====== Serendipity v1.6 CMS - Multiple Web Vulnerabilities Date: ===== 2012-05-05 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=535 VL-ID: ===== 535 Common Vulnerability Scoring System: ==================================== 5 Introduction: =============...

Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability

Advisory: Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability Advisory ID: KORAMIS-ADV2012-001 Contact: [email protected] Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.6 Vendor URL: http://www.s9y.org Vendor Status: fixed...

Serendipity 1.6 Cross Site Scripting / SQL Injection

Advisory: Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability Advisory ID: KORAMIS-ADV2012-001 Contact: [email protected] Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.6 Vendor URL: http://www.s9y.org Vendor Status: fixed...

Serendipity 1.6 Backend XSS And SQLi Vulnerability

Exploit for php platform in category web applications Serendipity 1.6 Backend XSS And SQLi Vulnerability Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.6 Vendor URL: http://www.s9y.org Vendor Status: fixed CVE-ID: CVE-2012-2331,CVE-2012-2332...

S9Y Serendipity 1.6 - Backend Cross-Site Scripting SQL Injection

S9Y Serendipity 1.6 - Backend Cross-Site Scripting SQL Injection Advisory: Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability Advisory ID: KORAMIS-ADV2012-001 Contact: [email protected] Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.6...

S9Y Serendipity 1.6 - 'Backend' Cross-Site Scripting / SQL Injection

Advisory: Serendipity 1.6 Backend Cross-Site Scripting and SQL-Injection vulnerability Advisory ID: KORAMIS-ADV2012-001 Contact: [email protected] Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.6 Vendor URL: http://www.s9y.org Vendor Status: fixed CVE-ID:...

Serendipity v1.6 CMS - Multiple Web Vulnerabilities

Document Title: =============== Serendipity v1.6 CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=535 Release Date: ============= 2012-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 535...

Serendipity v1.6 CMS - Multiple Web Vulnerabilities

Document Title: =============== Serendipity v1.6 CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=535 Release Date: ============= 2012-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 535...

Serendipity PHP Weblog System Remote Command Execution

Exploit for php platform in category web applications postProcess'', $quality, $type . "$filename"; //if we have windows server ifisset$ENV'OS' && eregi'window',$ENV'OS' $cmd = eregreplace'/','\',$cmd; //echo $cmd.""; $output = system$cmd; errorlog'NETPBM: '.$cmd; //errorlog$output; $this-command...

Serendipity Plugin 'Karma Ranking' Multiple Cross-Site Scripting

Advisory: Serendipity Plugin 'Karma Ranking' Multiple Cross-Site Scripting vulnerabilities Advisory ID: SSCHADV2011-017 Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.5.5 with Karma Ranking Plugin version 1.1 Vendor URL: http://www.s9y.org Vendor Status: fixed...

Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability

Advisory: Serendipity 'serendipityfilterbp.ALT' Cross-Site Scripting vulnerability Advisory ID: SSCHADV2011-015 Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.5.5 Vendor URL: http://www.s9y.org Vendor Status: fixed CVE-ID: - ========================== Vulnerability...

S9Y Serendipity 1.5.5 - serendipity[filter][bp.ALT] Cross-Site Scripting

S9Y Serendipity 1.5.5 - serendipityfilterbp.ALT Cross-Site Scripting source: https://www.securityfocus.com/bid/50502/info Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute...

Serendipity Karma Ranking 1.1 Cross Site Scripting

Advisory: Serendipity Plugin 'Karma Ranking' Multiple Cross-Site Scripting vulnerabilities Advisory ID: SSCHADV2011-017 Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.5.5 with Karma Ranking Plugin version 1.1 Vendor URL: http://www.s9y.org Vendor Status: fixed...

Serendipity 1.5.5 Cross Site Scripting

Advisory: Serendipity 'serendipityfilterbp.ALT' Cross-Site Scripting vulnerability Advisory ID: SSCHADV2011-015 Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.5.5 Vendor URL: http://www.s9y.org Vendor Status: fixed CVE-ID: - ========================== Vulnerability...

S9Y Serendipity 1.5.5 - 'serendipity[filter][bp.ALT]' Cross-Site Scripting

source: https://www.securityfocus.com/bid/50502/info Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the contex...

S9Y Serendipity Freetag-plugin 3.23 - serendipity[tagview] Cross-Site Scripting

S9Y Serendipity Freetag-plugin 3.23 - serendipitytagview Cross-Site Scripting source: https://www.securityfocus.com/bid/49771/info Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage thi...

S9Y Serendipity Freetag-plugin 3.23 - 'serendipity[tagview]' Cross-Site Scripting

source: https://www.securityfocus.com/bid/49771/info Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting use...

Serendipity 1.5.5 Freetag Cross Site Scripting

Advisory: Serendipity freetag plugin 'serendipitytagview' Cross-Site Scripting vulnerability Advisory ID: SSCHADV2011-016 Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.5.5 Vendor URL: http://www.s9y.org Vendor Status: fixed CVE-ID: - ==========================...

Serendipity freetag plugin 'serendipity[tagview]' Cross-Site Scripting vulnerability

Advisory: Serendipity freetag plugin 'serendipitytagview' Cross-Site Scripting vulnerability Advisory ID: SSCHADV2011-016 Author: Stefan Schurtz Affected Software: Successfully tested on Serendipity 1.5.5 Vendor URL: http://www.s9y.org Vendor Status: fixed CVE-ID: - ==========================...