PBX Phone System 2.x - Multiple Vulnerabilities

PenTest Information: ==================== Global-Evolution Security Team remove discover multiple Vulnerabilities on PBX Phone System Application. An attacker can get sensitive customer/admin session-data over multiple Cross-Site-Scripting vulnerabilities. Details ======= Tested on OS: Windows 7...

PBX Phone System 2.x - Multiple Vulnerabilities

PBX Phone System 2.x - Multiple Vulnerabilities PenTest Information: ==================== Global-Evolution Security Team remove discover multiple Vulnerabilities on PBX Phone System Application. An attacker can get sensitive customer/admin session-data over multiple Cross-Site-Scripting...

Sql injection

SQL injection vulnerability in viewlisting.php in Vastal I-Tech Agent Zone aka The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

Sql injection

SQL injection vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the magid parameter, a different vector than CVE-2008-4465...

Cross site scripting

Cross-site scripting XSS vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the magid parameter...

Sql injection

SQL injection vulnerability in viewnews.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the newsid parameter. NOTE: the gameid vector is already covered by CVE-2008-4460...

CVE-2009-3497

SQL injection vulnerability in viewlisting.php in Vastal I-Tech Agent Zone aka The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2009-3495

SQL injection vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the magid parameter, a different vector than CVE-2008-4465...

CVE-2009-3505

SQL injection vulnerability in viewnews.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the newsid parameter. NOTE: the gameid vector is already covered by CVE-2008-4460...

CVE-2009-3496

Cross-site scripting XSS vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the magid parameter...

CVE-2009-3495

SQL injection vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to execute arbitrary SQL commands via the magid parameter, a different vector than CVE-2008-4465...

CVE-2009-3497

SQL injection vulnerability in viewlisting.php in Vastal I-Tech Agent Zone aka The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2009-3495

CVE-2009-3495 describes an SQL injection in view_mag.php of Vastal I-Tech DVD Zone, exploitable via the mag_id parameter to execute arbitrary SQL commands. This mirrors the vulnerability family seen in CVE-2008-4465 but with a different input vector. The description across sources confirms a remo...

CVE-2009-3496

CVE-2009-3496 describes a cross-site scripting (XSS) vulnerability in the Vastal I-Tech DVD Zone’s view_mag.php, exploitable via the mag_id parameter to inject arbitrary script/HTML. Affected component is the server-side script handling mag_id in that application. The connected documents corrobor...

CVE-2009-3505

SQL injection vulnerability in viewnews.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the newsid parameter. NOTE: the gameid vector is already covered by CVE-2008-4460...

CVE-2009-3497

Vastal I-Tech Agent Zone (aka The Real Estate Script) is affected by CVE-2009-3497 due to an SQL injection in view_listing.php via the id parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands. The affected component is the view_listing.php script; the root cause i...

CVE-2009-3505

The CVE-2009-3505 entry documents a SQL injection vulnerability in view_news.php of the Vastal I-Tech MMORPG Zone, exploitable via the news_id parameter. The underlying issue is improper handling of user-supplied input in a SQL query, enabling remote attackers to execute arbitrary SQL commands. T...

CVE-2009-3497: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in viewlisting.php in Vastal I-Tech Agent Zone aka The Real Estate Script allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2009-3505: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in viewnews.php in Vastal I-Tech MMORPG Zone allows remote attackers to execute arbitrary SQL commands via the newsid parameter. NOTE: the gameid vector is already covered by CVE-2008-4460...

CVE-2009-3496: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in viewmag.php in Vastal I-Tech DVD Zone allows remote attackers to inject arbitrary web script or HTML via the magid parameter...