1505 matches found
Outfront Spooky 2.x - Login SQL Query Manipulation Password
source: https://www.securityfocus.com/bid/4661/info Spooky Login is a commerical web access control and account management software package. It is distributed and maintained by Outfront, and is designed for Microsoft IIS Webservers. Under some circumstances, it may be possible for a remote user t...
Outfront Spooky 2.x - Login SQL Query Manipulation Password
Outfront Spooky 2.x - Login SQL Query Manipulation Password source: https://www.securityfocus.com/bid/4661/info Spooky Login is a commerical web access control and account management software package. It is distributed and maintained by Outfront, and is designed for Microsoft IIS Webservers. Unde...
Snitz Forums 2000 remote SQL query manipulation vulnerability
vulnerable ---------- Product : Snitz Forums 2000 Version : 3.3 3.3.01 3.3.02 3.3.03 last stable version Object : members.asp Class : Input validation error remote SQL query manipulation vulnerability Vendor-URL : http://forum.snitz.com/ Vendor-Status : informed, not patched Remote-Exploit : yes...
Code injection in PHPGroupware
It's possible to inject PHP code and to modify SQL query...
CVE-2001-1226
AdCycle 1.17 and earlier allow remote attackers to modify SQL queries, which are not properly sanitized before being passed to the MySQL database...
CVE-2001-1226
AdCycle 1.17 and earlier allow remote attackers to modify SQL queries, which are not properly sanitized before being passed to the MySQL database...
Модификация SQL-запроса в adrotate (SQL modification)
Возможно модифицировать SQL-запрос в CGI-приложении...
phpBB 1.4.2, Remote user is able to modify SQL query.
Hi, there is a a potential security problem in the current version 1.4.2 and previous versions of phpBB http://www.phpbb.com. A remote user is able to modify a string passed as a SQL query to the MySQL database. The problem exists in the file bbmemberlist.php. A string called $sortby is supplied...
Модификация SQL-запроса во многих модулях авторизации Apache, PAM и т.д.
Ввод пользователя не проверяется на наличие служебных символов SQL...
Microsoft Index Server 2.0 - File Information / Full Path Disclosure
source: https://www.securityfocus.com/bid/3339/info The sqlqhit.asp sample file is used for performing web-based SQL queries. Malicious users could send specifically crafted HTTP request to an Internet Information Services server running Index Server to reveal path information, file attributes, a...
phpBB 1.4 - SQL Query Manipulation
source: https://www.securityfocus.com/bid/3142/info phpBB is free, open-source, easy-to-use web forums software. An issue exists in phpBB which allows a remote attacker to manipulate SQL queries in such a way as to gain an administrative account with the service. This problem is due to improper...
phpBB 1.4 - SQL Query Manipulation
phpBB 1.4 - SQL Query Manipulation source: https://www.securityfocus.com/bid/3142/info phpBB is free, open-source, easy-to-use web forums software. An issue exists in phpBB which allows a remote attacker to manipulate SQL queries in such a way as to gain an administrative account with the service...
Дырка в AdCycle
Недостаточная проверка ввода опльзователя при составлении SQL-запроса...
CVE-2001-0425
AdLibrary.pm in AdCycle 0.78b allows remote attackers to gain privileges to AdCycle via a malformed Agent: header in the HTTP request, which is inserted into a resulting SQL query that is used to verify login information...
TWIG SQL query bugs
I can't find the person who really in charge on developing twig, so I mail about this bug to the person who announce new version of twig about two month ago. -------------------------------------------------------------------------- Subject: Unquoted SQL query = potential damage Software package:...
CVE-2001-0425
AdLibrary.pm in AdCycle 0.78b allows remote attackers to gain privileges to AdCycle via a malformed Agent: header in the HTTP request, which is inserted into a resulting SQL query that is used to verify login information...
CVE-2001-0425
CVE-2001-0425 affects AdLibrary.pm in AdCycle 0.78b. The vulnerability stems from a malformed Agent: header in HTTP requests, which is inserted into a login-verification SQL query, enabling remote attackers to gain privileges. Documents explicitly describe the component and the root cause (SQL in...
CVE-2001-0234
NewsDaemon before 0.21b allows remote attackers to execute arbitrary SQL queries and gain privileges via a malformed userusername parameter...