CVE-2008-7091: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to vote.php, which is not properly handled in libs/link.php; 2 id parameter to trackback.php; 3 an unspecified parameter to submit.php; 4 requestTitle...

CVE-2008-6968

CVE-2008-6968 affects Pligg CMS 9.9.5. The vulnerability path is in submit.php, where multiple SQL injection flaws allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters. The NVD description explicitly states these parameters as injection vectors. Impa...

CVE-2008-6968: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in submit.php in Pligg CMS 9.9.5 allow remote attackers to execute arbitrary SQL commands via the 1 category and 2 id parameters...

SIPS v0.2.2 Remote File Inclusion Vulnerability

/=============================================================================================================================================== | | o SIPS v0.2.2 Remote File Inclusion Vulnerability | | Software : SIPS v0.2.2 | Vendor : http://www.phpscripts-fr.net/scripts/hosted/sips022.zip |...

Vulnerabilities in LinksExchanger

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting уязвимостях в LinksExchanger. XSS: POST запрос на странице http://site/links/submit.php "body onload="alertdocument.cookie" В полях: Ваше имя или ник, Текстовое описание Вашей ссылки. Это persistent XSS - при заходе на страниц...

RSMScript 1.21 XSS/Insecure Cookie Handling Vulnerabilities

Exploit for unknown platform in category web applications =========================================================== RSMScript 1.21 XSS/Insecure Cookie Handling Vulnerabilities =========================================================== START 0x01 Informations: Script : RSMScript 1.21 Download :...

RSMScript 1.21 XSS/Insecure Cookie Handling Vulnerabilities

No description provided by source. START 0x01 Informations: Script : RSMScript 1.21 Download : http://www.hotscripts.com/jump.php?listingid=78547&jumptype=1 Vulnerability : Insecure Cookie Handling / XXS Author : Osirys Contact : osirysatlivedotit Website : http://osirys.org Notes : Proud to be...

RSMScript 1.21 - Cross-Site Scripting / Insecure Cookie Handling

START 0x01 Informations: Script : RSMScript 1.21 Download : http://www.hotscripts.com/jump.php?listingid=78547&jumptype=1 Vulnerability : Insecure Cookie Handling / XXS Author : Osirys Contact : osirysatlivedotit Website : http://osirys.org Notes : Proud to be Italian Greets: : XaDoS, x0r, emgent...

Sql injection

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magicquotesgpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submitinfo parameter in a link submission action. NOTE: it was later...

PHP-Fusion submit.php文件SQL注入漏洞

BUGTRAQ ID: 28855 PHP-Fusion是一款基于PHP的内容管理系统。 PHP-Fusion的submit.php文件没有正确地过滤对submitinfo参数的输入便在SQL查询中使用，远程攻击者可能利用此漏洞执行SQL注入攻击。 相关代码： 1. if $stype == "l" 2. 3. if isset$POST'submitlink' 4. 5. if $POST'linkname' != "" && $POST'linkurl' != "" && $POST'linkdescription' != "" 6. $submitinfo'linkcategory...

CVE-2008-1918

PHP-Fusion is affected by an SQL injection in submit.php affecting versions 6.01.14 and 6.00.307 (note: later reported in 7.00.2). The vulnerability occurs when magic_quotes_gpc is disabled and the database table prefix is known, allowing remote authenticated users to execute arbitrary SQL via th...

CVE-2008-1918: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magicquotesgpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submitinfo parameter in a link submission action. NOTE: it was later...

phpfusion-sql.py.txt

!/usr/bin/python """ ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / ================================================================================================= This was a priv8 Exploit...

PHP-Fusion 6.01.14 - Blind SQL Injection

!/usr/bin/python """ ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / / ================================================================================================= This was a priv8 Exploit...

PHP-Fusion 6.01.14 - Blind SQL Injection

PHP-Fusion 6.01.14 - Blind SQL Injection !/usr/bin/python """ ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | | |||| /| / /...

PHP-Fusion <= 6.01.14 Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/python """ ================================================================================================= / | |\ \ / | / |/ | | |/ \ | | / \ \ | \ \ | | | \ | |/ \ | | // | || | ||| /| / /\ | |||| /| / /...

CVE-2008-0426

Multiple cross-site scripting XSS vulnerabilities in submit.php in PacerCMS before 0.6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 headline, or 3 text field in a message...

CVE-2008-0426

CVE-2008-0426 concerns multiple XSS vulnerabilities in PacerCMS before 0.6.1, exploitable via the name, headline, or text fields in submit.php within a message. The underlying issue is a failure to adequately sanitize user input, enabling remote attackers to inject arbitrary web script or HTML. T...

CVE-2008-0426: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in submit.php in PacerCMS before 0.6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 headline, or 3 text field in a message...

CVE-2007-6545: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via 1 the subject parameter to modules/news/submit.php; 2 the PATHINFO to modules/news/index.php, possibly related to the XoopsPageNav class; or 3 an avatar image...