Open redirect

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action...

Sql injection

SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-7268

The phpinfo function in SiteEngine 5.x allows remote attackers to obtain system information by setting the action parameter to phpinfo in misc.php...

CVE-2008-7269

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action...

CVE-2008-7267

CVE-2008-7267 describes a SQL injection in SiteEngine 5.x, specifically in announcements.php, where the vulnerable parameter is id. The root cause is improper handling of user input leading to arbitrary SQL execution by remote attackers. Impact is partial confidentiality/integrity/availability lo...

CVE-2008-7269

CVE-2008-7269 is an open-redirect flaw affecting SiteEngine 5.x (notably in api.php) where a user-controlled forward parameter in a logout action can redirect victims to arbitrary sites. The vulnerability enables user-assisted remote attack chains for phishing or similar redirects. The Nuclei tem...

CVE-2008-7268

SiteEngine 5.x is affected by CVE-2008-7268 via a phpinfo information-disclosure in misc.php when action=php_info is supplied, allowing remote attackers to obtain system information. The connected documents reiterate the description; no remediation patch/version is provided in the supplied source...

CVE-2008-7267

SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2010-4357

CVE-2010-4357: SiteEngine 7.1 contains a SQL injection in comments.php via the module parameter, enabling remote arbitrary SQL execution. Technical detail: vulnerable component is the comments.php handler in SiteEngine 7.1; exploit vector is passing crafted module parameters to trigger SQL comman...

CVE-2010-4357

SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...

PT-2010-5434

Name of the Vulnerable Software and Affected Versions SiteEngine version 7.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the module parameter in comments.php. Recommendations For SiteEngine version 7.1, avoid using the module parameter in...

CVE-2010-4357: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in comments.php in SiteEngine 7.1 allows remote attackers to execute arbitrary SQL commands via the module parameter...

CVE-2008-7267: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-7269: Improper Input Validation

Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action...

PT-2010-1258

Name of the Vulnerable Software and Affected Versions SiteEngine versions 5.x Description The issue allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the forward parameter in a logout action in the api.php...

PT-2010-1257

Name of the Vulnerable Software and Affected Versions SiteEngine versions 5.x Description The issue allows remote attackers to obtain system information. This is achieved by setting the action parameter to php info in the "misc.php" endpoint. Recommendations For SiteEngine versions 5.x, consider...

CVE-2008-7268: Exposure of Sensitive Information to an Unauthorized Actor

The phpinfo function in SiteEngine 5.x allows remote attackers to obtain system information by setting the action parameter to phpinfo in misc.php...

PT-2010-1256

Name of the Vulnerable Software and Affected Versions SiteEngine versions 5.x Description The issue allows remote attackers to execute arbitrary SQL commands via the id parameter in the announcements.php file. Recommendations For SiteEngine versions 5.x, avoid using the id parameter in the...

SiteEngine 6.0 XSS vulnerability

网站引擎SiteEngine,全称：博卡网站引擎管理系统，软件基于PHP程序和Mysql数据库开发，采用B/S体系结构。 POC: http://server/comments.php?module=news&id=XSS http://server/news.php?pagestart=1&classid=XSS http://server/search.php?searchword=XSS SiteEngine 6.0 厂商补丁： SiteEngine ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

SiteEngine 6.0 &7.1 SQL injection vulnerability-vulnerability warning-the black bar safety net

Title: SiteEngine 6.0 SQL injectionvulnerability Date: 2010-11-25 Author: Beach Team: www.linux520.com Vendors: www.siteengine.netwww.boka.cn Keywords: "Powered by SiteEngine" //300,000 + Description: The use of this vulnerability requires that the comment function is turned ONON by default The u...