RoseOnlineCMS <= 3 B1 (admin) Local File Inclusion

No description provided by source. '/ -.- --------------------oOO------OOo------------------- | RoseOnlineCMS = 3 B1 admin Local File Inclusion | | works only with magicquotesgpc = off | ------------------------------------------------------ ! Discovered: cr4wl3r cr4wl3r!linuxmail.org ! Download:...

Stash 1.0.3 Cross Site Scripting

Author: Author: Mr.SeCreT E-mail: [email protected] From: Syria http://english.islamweb.net/ Script Information: Script: Stash 1.0.3 Remote XSS Vulnerability Language: PHP Download: http://garr.dl.sourceforge.net/project/nice-stash/Stash%20CMS/1.0.3/stash-1.0.3.zip Vul Code: footer.inc.php: "My In...

RoseOnlineCMS 3 B1 - 'admin' Local File Inclusion

'/ -.- --------------------oOO------OOo------------------- | RoseOnlineCMS ! Download: http://sourceforge.net/projects/rosecms/files/ ! Date: 30.12.2009 ! Remote: yes ! Code : Click here to go back home'; obendflush; ? ! PoC: RoseOnlineCMSpath/modules/admincp.php?admin=LFI%00...

Cybershade CMS 0.2 Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ====================================================== Cybershade CMS 0.2 Remote File Inclusion Vulnerability ====================================================== Language: PHP Download:...

Cybershade CMS 0.2 Remote File Inclusion Vulnerability

No description provided by source. Author: Author: Mr.SeCreT E-mail: [email protected]:[email protected] From: Syria http://english.islamweb.net/ Script Information: Script: Cybershade CMS 0.2 Remote File Inclusion Vulnerability Language: PHP Download:...

CoreHTTP 0.5.3.1 - 'CGI' Arbitrary Command Execution

Package name: CoreHTTP server Version: 0.5.3.1 and below as long as cgi support is enabled Software URL: http://corehttp.sourceforge.net/ Exploit: http://aconole.brad-x.com/programs/corehttpcgienabled.rb Issue: CoreHTTP server fails to properly sanitize input before calling popen and allows an...

pragmaMx Blind SQL Injection

CMS Name : pragmaMx All Version Bug Type : Blind SQL/XPath Injection vulnerability Found by : Hadi Kiamarsi Contact : hadikiamarsi at hotmail.com Download : http://sourceforge.net/projects/pragmamx/files/pragmaMx%20%20%28full%29/pragmaMx%200.1.11/pragmaMx0.1.11.0.tar.gz/download PoC :...

pragmaMx CMS Blind SQL/XPath Injection vulnerability

No description provided by source. CMS Name : pragmaMx All Version Bug Type : Blind SQL/XPath Injection vulnerability Found by : Hadi Kiamarsi Contact : hadikiamarsi at hotmail.com Download : http://sourceforge.net/projects/pragmamx/files/pragmaMx%20%20%28full%29/p ...

Ptag 4.0.0 Remote File Inclusion

Exploit Title: Ptag sqltable = ptagprefix."session"; $this - cookiename = ptagprefix."session"; //If RSS mode, switch session to non-viewed tracker. if ptagoutput == "rss" parent::construct$ptagsql, sha1""; else parent::construct$ptagsql; ? PoC Ptagpath/lib/session.php?ptagdir=Shell Code sql.php...

Lizard Cart - Multiple SQL Injections

Lizard Cart - Multiple SQL Injections Exploit Title: Lizard Cart Multiple SQL Injection Exploit Date: 20-12-2009 Author: cr4wl3r Software Link: http://sourceforge.net/projects/lizardcart/ Version: N/A Tested on: GNU/LINUX Code detail.php $dbResult = mysqlquery"select from products where id='$id'"...

Ptag 4.0.0 - Multiple Remote File Inclusions

Ptag 4.0.0 - Multiple Remote File Inclusions Exploit Title: Ptag sqltable = ptagprefix."session"; $this - cookiename = ptagprefix."session"; //If RSS mode, switch session to non-viewed tracker. if ptagoutput == "rss" parent::construct$ptagsql, sha1""; else parent::construct$ptagsql; ? PoC...

Ptag 4.0.0 - Multiple Remote File Inclusions

Exploit Title: Ptag sqltable = ptagprefix."session"; $this - cookiename = ptagprefix."session"; //If RSS mode, switch session to non-viewed tracker. if ptagoutput == "rss" parent::construct$ptagsql, sha1""; else parent::construct$ptagsql; ? PoC Ptagpath/lib/session.php?ptagdir=Shell Code sql.php...

Lizard Cart Multiple SQL Injection Exploit

No description provided by source. Exploit Title: Lizard Cart Multiple SQL Injection Exploit Date: 20-12-2009 Author: cr4wl3r Software Link: http://sourceforge.net/projects/lizardcart/ Version: N/A Tested on: GNU/LINUX Code detail.php $dbResult = mysqlquery"select from products where id='$id'"; P...

CFAGCMS SQL Injection Exploit

Exploit for unknown platform in category web applications ============================= CFAGCMS SQL Injection Exploit ============================= Exploit Title: CFAGCMS SQL Injection Exploit Date: 20-12-2009 Author: cr4wl3r Software Link:...

CFAGCMS SQL Injection Exploit

No description provided by source. Exploit Title: CFAGCMS SQL Injection Exploit Date: 20-12-2009 Author: cr4wl3r Software Link: http://sourceforge.net/project/showfiles.php?groupid=197936 Version: N/A Tested on: GNU/LINUX Code right.php $title = $GET'title'; $query = "SELECT FROM pages WHERE titl...

Lizard Cart - Multiple SQL Injections

Exploit Title: Lizard Cart Multiple SQL Injection Exploit Date: 20-12-2009 Author: cr4wl3r Software Link: http://sourceforge.net/projects/lizardcart/ Version: N/A Tested on: GNU/LINUX Code detail.php $dbResult = mysqlquery"select from products where id='$id'"; PoC lizardcartpath/detail.php?id=SQL...

CFAGCMS - SQL Injection

CFAGCMS - SQL Injection Exploit Title: CFAGCMS SQL Injection Exploit Date: 20-12-2009 Author: cr4wl3r Software Link: http://sourceforge.net/project/showfiles.php?groupid=197936 Version: N/A Tested on: GNU/LINUX Code right.php $title = $GET'title'; $query = "SELECT FROM pages WHERE title =...

CFAGCMS - SQL Injection

Exploit Title: CFAGCMS SQL Injection Exploit Date: 20-12-2009 Author: cr4wl3r Software Link: http://sourceforge.net/project/showfiles.php?groupid=197936 Version: N/A Tested on: GNU/LINUX Code right.php $title = $GET'title'; $query = "SELECT FROM pages WHERE title = '".$title."'"; $result =...

gpEasy <= 1.5RC3 Remote FIle Include Exploit

No description provided by source. Exploit Title: gpEasy = 1.5RC3 Remote FIle Include Exploit Date: 18-12-2009 Author: cr4wl3r Software Link: http://sourceforge.net/projects/gpeasy/files/ Version: N/A Tested on: GNU/LINUX Code adminpassword.php :...

gpEasy <= 1.5RC3 Remote FIle Include Exploit

Exploit for unknown platform in category web applications ============================================ gpEasy = 1.5RC3 Remote FIle Include Exploit ============================================ Exploit Title: gpEasy = 1.5RC3 Remote FIle Include Exploit Date: 18-12-2009 Author: cr4wl3r Software Link...