Code injection

MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service infinite loop via multiple invocations of a 1 prepared statement or 2 stored procedure that creates a query with nested JOIN statements...

KLINK - SQL Injection

Andr�s G�mez Exploit Title : KLINK Sql Injection Vulnerability Date : 2010-12-31 Author : Andr�s G�mez Software Developed by : http://www.contacto.com Contact : [email protected] Dork : "allinurl:.php?txtCodiInfo=" An attacker may execute arbitrary SQL statements on the vulnerable system...

PT-2010-3833

Name of the Vulnerable Software and Affected Versions Cobbler versions prior to 2.0.7 Description The issue allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file. This is due to the template api.py file not disabling the ability of the Cheetah...

Sybase PowerDesigner Repository Proxy Detection

The remote service is a Sybase PowerDesigner Repository Proxy, which allows users to issue SQL statements via an ODBC connection to be executed on the database server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description...

MySQL Community Server 5.1 < 5.1.52 Multiple Vulnerabilities

The version of MySQL Community Server 5.1 installed on the remote host is earlier than 5.1.52 and thus potentially affected by multiple vulnerabilities: - An error exists in the handling of 'EXPLAIN' for a 'SELECT' statement from a derived table which can cause the server to crash. 54488 - An err...

CVE-2010-3839

MySQL 5.1 before 5.1.51 and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service infinite loop via multiple invocations of a 1 prepared statement or 2 stored procedure that creates a query with nested JOIN statements...

Update : Havij v1.13 automated SQL Injection tool - New version

Update : Havij v1.13 automated SQL Injection tool - New version "Havij is an automated SQL Injection tool that helps penetration testers to find and exploit SQL Injection vulnerabilities on a web page. It can take advantage of a vulnerable web application. By using this software user can perform...

MySQL: crash when group_concat and "with rollup" in prepared statements (MySQL Bug#54476)

MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service server crash via a prepared statement that uses GROUPCONCAT with the WITH ROLLUP modifier, probably triggering a use-after-free error when a copied object is modified in...

PT-2011-1441

Name of the Vulnerable Software and Affected Versions MySQL versions 5.1 before 5.1.51 MySQL versions 5.5 before 5.5.6 Description The issue allows remote authenticated users to cause a denial of service, resulting in an infinite loop. This can be achieved through multiple invocations of a prepar...

Authentication flaw

The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this issue, stating that the...

CVE-2010-4121: Improper Authentication

The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this issue, stating that the...

Symantec IM Manager Administrative Interface SummaryReportGroup.lgx Definition File SQL Injection Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rdpageimlogic.aspx page which is exposed through an IIS extension on the defau...

Symantec IM Manager Administrative Interface rdpageimlogic.aspx SQL Injection Vulnerabilities

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec IM Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the rdpageimlogic.aspx page which is exposed through an IIS extension on the defau...

Cag CMS 0.2 - Cross-Site Scripting / Blind SQL Injection

----------------------------------------------------------------------------------------- Cag CMS Version 0.2 Beta = XSS && Blind SQL Injection Multiple Vulnerabilities ----------------------------------------------------------------------------------------- Author : Shamus Date : October, 05th...

XOOPS 2.0.14 SQL Injection

/ \ / | | | \ / | | | | | | | | | | || | | | | | | | | '| | | | | | | | | | |/ \ / |/ / / | | | | || | || | || || | / || | | | / | | || / / |/ || ,|\|,| +-+-+-+-+ |C|r|e|w| +-+-+-+-+ XOOPS 2.0.14 article.php SQL Injection Vulnerability Discovered By 0iZy5 http://r00tDefaced.com &...

XOOPS 2.0.14 (article.php) SQL Injection Vulnerability

Exploit for php platform in category web applications ====================================================== XOOPS 2.0.14 article.php SQL Injection Vulnerability ====================================================== / \ / | | | \ / | | | | | | | | | | || | | | | | | | | '| | | | | | | | | | |/ ...

XOOPS 2.0.14 - 'article.php' SQL Injection

/ \ / | | | \ / | | | | | | | | | | || | | | | | | | | '| | | | | | | | | | |/ \ / |/ / / | | | | || | || | || || | / || | | | / | | || / / |/ || ,|\|,| +-+-+-+-+ |C|r|e|w| +-+-+-+-+ XOOPS 2.0.14 article.php SQL Injection Vulnerability Discovered By 0iZy5 http://r00tDefaced.com &...

Oracle MySQL 5.1.50 - Privilege Escalation

Oracle MySQL 5.1.50 - Privilege Escalation source: https://www.securityfocus.com/bid/43677/info MySQL is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to run arbitrary SQL statements with 'SUPER' privileges on the slave database system. This will allow t...

Oracle Database InterMedia Denial of Service

Oracle Database Server is an enterprise-level relational database application suite. In addition to common basic data types, such as INT or VARCHAR, Oracle uses specialized object types to store and manage complex data objects, such as images and audio/video data. Object types are conceptually...

Gekko CMS SQL Injection

/ \ / | | | \ / | | | | | | | | | | || | | | | | | | | '| | | | | | | | | | |/ \ / |/ / / | | | | || | || | || || | / || | | | / | | || / / |/ || ,|\|,| +-+-+-+-+ |C|r|e|w| +-+-+-+-+ Gekko CMS SQL Injection Vulnerability Discovered By 0iZy5 http://r00tDefaced.com Greetz: sHoKeD-bYte,...