SlimarUSER Management 1.0 SQL Injection

Exploit Title: SlimarUSER Management v1.0 a 'id' Parameter SQL Injection Date: 03.02.2017 Vendor Homepage: http://slimar.org Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits Overview SlimarUSER is a PHP user management system ful...

Zoneminder 1.29 / 1.30 CSRF / XSS / SQL Injection / Session Fixation

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 === FOXMOLE - Security Advisory 2016-07-05 === Zoneminder multiple vulnerabilities Affected Versions ================= Zoneminder 1.29,1.30 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Session Fixation, No...

Complain Management System SQL Injection

Title : Complain Management System SQL Injection Date: 20 January 2017 Exploit Author: Sibusiso Sishi [email protected] Tested on: Windows7 x32 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download Software:...

Complain Management System - SQL injection Vulnerability

Exploit for php platform in category web applications Title : Complain Management System SQL Injection Date: 20 January 2017 Exploit Author: Sibusiso Sishi email protected Tested on: Windows7 x32 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download...

Complain Management System - SQL injection

Title : Complain Management System SQL Injection Date: 20 January 2017 Exploit Author: Sibusiso Sishi [email protected] Tested on: Windows7 x32 Vendor: https://sourceforge.net/projects/complain-management-system/ Version: not supplied Download Software:...

B2B Script 4.27 SQL Injection

Vulnerability: B2B Script v4.27 - SQL Injection Date: 18.01.2017 Software link: http://itechscripts.com/b2b-script/ Demo: http://b2b.itechscripts.com Price: 199$ Category: webapps Exploit Author: Dawid Morawski Website: http://www.morawskiweb.pl Contact: [email protected] 1. Description...

Courier Management System Cross Site Scripting / SQL Injection

Title : Courier Management System - Sql Injection and non-persistent XSS login portal Date: 17 January 2017 Exploit Author: Sibusiso Sishi [email protected] Tested on: Windows7 x32 Vendor: http://couriermanageme.sourceforge.net/ Version: not supplied Download Software:...

OpenExpert 0.5.17 SQL Injection

Title : Openexpert 0.5.17 - Sql Injection Author: Nassim Asrir Author Company: Henceforth Tested on: Winxp sp3 - win7 Vendor: https://sourceforge.net/projects/law-expert/ Download Software: https://sourceforge.net/projects/law-expert/files/ About The Product : OpenExpert. Dual use Web based and...

Openexpert 0.5.17 - SQL Injection Vulnerability

Exploit for php platform in category web applications Title : Openexpert 0.5.17 - Sql Injection Author: Nassim Asrir Author Company: Henceforth Tested on: Winxp sp3 - win7 Vendor: https://sourceforge.net/projects/law-expert/ Download Software: https://sourceforge.net/projects/law-expert/files/...

Courier Management System - SQL Injection

Courier Management System - SQL Injection Title : Courier Management System - Sql Injection and non-persistent XSS login portal Date: 17 January 2017 Exploit Author: Sibusiso Sishi [email protected] Tested on: Windows7 x32 Vendor: http://couriermanageme.sourceforge.net/ Version: not supplied...

Haraj v2 Script SQL injection Vulnerability

Exploit for php platform in category web applications |----------------------------| | xBADGIRL21 | | N3W PUBLIC 3XPL0IT | | , | | 0day T == -- | | /-' | | // | | x21 | |----------------------------| | Exploit Title : Haraj v2 Script SQL injection Vulnerability | Exploit Author : xBADGIRL21 | Dor...

Wordpress cmw-speakers Plugin SQL injection Vulnerability

Exploit for php platform in category web applications |----------------------------| | xBADGIRL21 | | N3W PUBLIC 3XPL0IT | | , | | 0day T == -- | | /-' | | // | | x21 | |----------------------------| | Exploit Title : Wordpress cmw-speakers Plugin SQL injection Vulnerability | Exploit Author :...

U.S. Dept Of Defense: SQL injection found in US Navy Website (http://███/)

Summary: SQL injection found in US Navy Website http://█████/ Description: SQL injection found in US Navy website, parameters are: /display.asp?storyid=98373 /listStories.asp?x=4 /viewVideo.asp?t=6 SQLmap commands: sqlmap.py -u http://█████/submit/display.asp?storyid=98373 --random-agent...

Joomla! Component Blog Calendar - SQL Injection

Joomla! Component Blog Calendar - SQL Injection ========================================================================================== Joomla comblogcalendar SQL Injection Vulnerability ==========================================================================================...

Joomla Blog Calendar SQL Injection

========================================================================================== Joomla comblogcalendar SQL Injection Vulnerability ==========================================================================================...

Joomla! Component Blog Calendar - SQL Injection

========================================================================================== Joomla comblogcalendar SQL Injection Vulnerability ==========================================================================================...

ZM Gallery 1.0 – Authenticated Blind SQL Injection

The plugin is still affected and has been closed. Type user access: admin user. $GET‘order’ is escaped wrong. Attack with Blind Injection python sqlmap.py -u "http://www.example.com/wp-admin/admin.php?page=zmgallery&orderby=name&order=desc" --dbs --cookie="cookie of admin user" --level=5...

ZM Gallery 1.0 – Authenticated Blind SQL Injection

The plugin is still affected and has been closed. Type user access: admin user. $GET‘order’ is escaped wrong. Attack with Blind Injection PoC python sqlmap.py -u "http://www.example.com/wp-admin/admin.php?page=zmgallery=name=desc" --dbs --cookie="cookie of admin user" --level=5 --dbms=mysql...

Wordpress Plugin Olimometer 2.56 - SQL Injection

Vulnerability parameters: olimometerid= Using sqlmap Parameter: olimometerid GET Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: olimometerid=1 AND 6227=6227 Type: AND/OR time-based blind Title: MySQL = 5.0.12 AND time-based blind Payload: olimometerid=1...

LocalTapiola: SQL Injection on /webApp/omatalousuk (viestinta.lahitapiola.fi)

I would like to report a SQL Injection vulnerability on viestinta.lahitapiola.fi Vulnerable Request: GET /webApp/omatalousuk?email=aaaaa HTTP/1.1 Host: viestinta.lahitapiola.fi User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.12; rv:49.0 Gecko/20100101 Firefox/49.0 Accept: text/html, /; q=0.0...