SUSE CVE-2015-9230

In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter...

Exploit for SQL Injection in Prestashop Blockwishlist

CVE-2022-31101 Exploit for PrestaShop bockwishlist module 2.1...

PT-2022-13251 · WordPress · Flo-Launch

Name of the Vulnerable Software and Affected Versions: flo-launch WordPress plugin versions prior to 2.4.1 Description: The issue allows an attacker to initiate a new site install by setting the flo custom table prefix cookie to an arbitrary value. This is possible because the plugin injects code...

PT-2021-10201 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 versions prior to 5.3.2.8 Description: The issue is related to a SQL Injection vulnerability. It can be exploited via the table prefix parameter in the install db.php file. Recommendations: For versions prior to 5.3.2.8, update to a...

GNUBOARD5 SQL注入漏洞

GNUBOARD5 is a Web forum system based on PHP and MySQL. A SQL injection vulnerability exists in GNUBOARD5 5.3.2.8 and earlier versions. The vulnerability can be exploited to conduct SQL injection attacks via the tableprefix parameter in installdb.php...

Arbitrary Code Execution Vulnerability in GolemCMS

GolemCMS is a PHP-based content management system CMS. An arbitrary code execution vulnerability exists in GolemCMS version 2008-12-24 and earlier. A remote attacker can execute arbitrary PHP code or obtain sensitive information by sending a direct request to the 'Table prefix' form field in...

CVE-2018-14579

GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for...

PT-2018-12589

Name of the Vulnerable Software and Affected Versions GolemCMS through 2008-12-24 Description The issue allows remote attackers to execute arbitrary PHP code by inserting this code into the Table prefix form field in the "Database Information" section, or obtain sensitive information via a direct...

CVE-2018-14579: Improper Control of Generation of Code

GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting this code into the "Database Information" "Table prefix" form field, or obtain sensitive information via a direct request for...

WordPress BulletProof Security Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed in PHP by the WordPress Software Foundation, which supports setting up personal blog sites on PHP and MySQL servers.BulletProof Security is one of the security plug-ins against brute-force cracking. A cross-site scripting vulnerability exists in the...

dz7. 2 faq. php vulnerability storm table prefix-vulnerability warning-the black bar safety net

action=grouppermission&gids9 9='&gids1 0 00= andselect 1 fromselect count,concatselect select SELECT distinct concathextablename FROM informationschema. the tables where tableschema=database limit 0,1 from informationschema. tables limit 0,1,floorrand02x from informationschema. tables group by xa...

exV2 <= 2.0.4.3 - (sort) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? printr' ------------------------------------------------------------------------------- exV2 = 2.0.4.3 sort SQL injection / administrative credentials disclosure exploit mail: [email protected] site:...

ibProArcade <= 3.3.0 - Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl ibProArcade = v3.3.0 sql injection exploit coded by 1dt.w0lf RST/GHC THIS IS UNPUBLISHED RST/GHC EXPLOIT CODE KEEP IT PRIVATE use Tk; use Tk::BrowseEntry; use Tk::DialogBox; use LWP::UserAgent; BEGIN if$^O eq 'MSWin32' require Win32::Console;...

X7 Chat <= 2.0.4 (old_prefix) Remote Blind SQL Injection Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo X7 Chat =2.0.4 'oldprefix' blind SQL injection / privilege escalation exploit\r\n; echo by rgod [email protected]\r\n; echo site: http://retrogod.altervista.org\r\n; echo dork: \Powered By X7 Chat\r\n\r\n; if $argc3...

LinPHA <= 1.3.1 (new_images.php) Remote Blind SQL Injection Exploit

No description provided by source. ?php / LinPHA = 1.3.1 newimages.php Remote Blind SQL Injection Hash Fishing Exploit / BENCHMARK method author...: EgiX mail.....: n0b0d1esathotmaildotcom link.....: http://linpha.sourceforge.net/ dork.....: LinPHA Version 1.3.x or The LinPHA developers vulnerabl...

YAP 1.1.1 - Blind SQL Injection/SQL Injection Vulnerabilities

No description provided by source. + YAP 1.1.1 Blind SQL Injection/SQL Injection + Discovered By SirGod + www.mortal-team.org + www.h4cky0u.org + Blind SQL Injection The default prefix for database tables is yap .But can be changed at installation. PoC : http://127.0.0.1/path/comments.php?imageid...

WP Comment Remix 1.4.3 - Remote SQL Injection Exploit

No description provided by source. ?php / WP Comment Remix 1.4.3 SQL Injection Proof of Concept By g30rg3x g30rg3xatchxsecuritydotorg Advisory: http://chxsecurity.org/advisories/adv-3-full.txt PoC Mirror: http://chxsecurity.org/proof-of-concepts/wp-comment-remix-143.zip Attention: This is a...

ThinkSNS某操作泄露数据库表前缀

简要描述： ThinkSNS某操作提交地址直接返回执行的SQL语句可获得数据库表前缀（影响不大） 详细说明： http://demo.thinksns.com/t3/index.php?app=public&mod=Account&act=doSaveProfile 个人设置的标签设置和基本信息 此提交地址 每次提交数据 返回时都将DB层SQL语句返回 可知网站数据表前缀 漏洞证明： http://demo.thinksns.com/t3/index.php?app=public&mod=Account&act=doSaveProfile...

One dedecms variable coverage holes of the wretched use of the method-vulnerability warning-the black bar safety net

The most recent dedecms variable coverage holes, and finally can control the global variables, but can not completely control $GLOBALS$v1 .= $v2; Note that there is a sliding scale, is in an initialized global variable content on a sliding scale the content. It has now been disclosed the exploit...

AVE.CMS 2.09 - 'index.php?module' Blind SQL Injection

!/usr/bin/env python import urllib, sys, time Exploit Title: AVE.CMS " if url:7 != "http://": url = "http://" + url + "/index.php?module=" else: url = url + "/index.php?module=" database = options = 'Version':'VERSION', 'User':'CURRENTUSER', 'Database':'DATABASE' sys.stdout.write"+ Checking...