Itech Multi Vendor Script 6.49 - pl SQL Injection

Itech Multi Vendor Script 6.49 - pl SQL Injection Exploit Title: Itech Multi Vendor Script 6.49 – SQL Injection Date: 30.01.2017 Vendor Homepage: http://itechscripts.com/ Software Link: http://itechscripts.com/multi-vendor-shopping-script/ Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom...

B2B Script 4.27 - SQL Injection

Vulnerability: B2B Script v4.27 - SQL Injection Date: 18.01.2017 Software link: http://itechscripts.com/b2b-script/ Demo: http://b2b.itechscripts.com Price: 199$ Category: webapps Exploit Author: Dawid Morawski Website: http://www.morawskiweb.pl Contact: [email protected] 1. Description...

Starbucks: Time-based Blind SQLi on news.starbucks.com

Hi, I just found that the post parameter "groupid" for a particularly crafted http request is being vulnerable to injection due to missing parameter sanitization. PoC: POST / HTTP/1.1 Host: news.starbucks.com Connection: close Content-Length: 81 Cache-Control: max-age=0 Origin:...

phpWebAdmin 1.0 SQL Injection Vulnerability

phpWebAdmin version 1.0 suffers from a remote SQL injection vulnerability. !/usr/bin/perl -w phpWebAdmin Version 1.0 SQL Injection Proof Of Concept Exploit =============================================================== Discovered by NA , NAattutanota.com ========================================...

Time-Based Information Disclosure Vulnerability in Flow

More info at https://www.neos.io/blog/flow-sa-2016-001.html...

Time-Based Information Disclosure Vulnerability in Flow

More info at https://www.neos.io/blog/flow-sa-2016-001.html...

NetBilleterie 2.8 SQL Injection / Information Disclosure

phpinfo 200 = http://localhost/netbilletterie/phpinfo.php SQL Injection Type: time-based blind 200 = http://localhost/netbilletterie/listerdetailbon.php?datedebut= 200 = http://localhost/netbilletterie/listerpointesok.php?datedebut= 302 = http://localhost/netbilletterie/deletearticle.php?article=...

NetBilleterie 2.8 SQL Injection / Information Disclosure

Exploit Title: NetBilletterie 2.8 | Multiple Vulnerabilities Date: 14/07/16 Exploit Author: Wadeek Website Author: https://github.com/Wad-Deek Vendor Homepage: http://net-billetterie.tuxfamily.org/ Software Link: https://sourceforge.net/projects/netbilletterie/files/ Demo Link:...

NetBilletterie 2.8 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: NetBilletterie 2.8 | Multiple Vulnerabilities Date: 14/07/16 Exploit Author: Wadeek Website Author: https://github.com/Wad-Deek Vendor Homepage: http://net-billetterie.tuxfamily.org/ Software Link:...

Exponent CMS 2.3.9 - Blind SQL Injection

Exponent CMS 2.3.9 - Blind SQL Injection ============================================= MGC ALERT 2016-005 - Original release date: September 09, 2016 - Last revised: September 20, 2016 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2016-7400...

Exponent CMS 2.3.9 - Blind SQL Injection

============================================= MGC ALERT 2016-005 - Original release date: September 09, 2016 - Last revised: September 20, 2016 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2016-7400 ============================================= I...

Exponent CMS 2.3.9 Blind SQL Injection

============================================= MGC ALERT 2016-005 - Original release date: September 09, 2016 - Last revised: September 20, 2016 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2016-7400 ============================================= I...

LocalTapiola: SQL Injection on `/cs/Satellite` path

Summary There exists an SQL Injection vulnerability on the path /cs/Satellite. This path accepts numerous fields, including blobtable, blobcol, blobkey and blobwhere. It is possible to sufficiently manipulate the the blobwhere field in order to trigger a time-based blind SQL Injection attack. Sco...

The vulnerability of the Thunderbird email client, which allows a malicious individual to gain access to confidential information

The Thunderbird email client contains a vulnerability related to errors in the implementation of the SVG filter. This vulnerability allows a malicious actor to gain access to confidential information about displacement and correlations, as well as to circumvent domain restriction policies. The...

The vulnerability of the Firefox ESR browser allows a malicious individual to gain access to confidential information.

The Mozilla Firefox ESR browser contains a vulnerability related to errors in the implementation of the SVG filter. This vulnerability allows a malicious actor to gain access to confidential information about displacement and correlations, as well as to circumvent Domain Restrictions Policy SOP...

The vulnerability of the Moodle learning management system allows a hacker to circumvent existing restrictions on access time limits.

The vulnerability of the savesubmission function in the Moodle learning management system’s code mod/assign/externallib.php is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing time-based access restrictions by using the...

Dokeos 2.2.1 - Blind SQL Injection

Exploit for php platform in category web applications Exploit Title: Dokeos Blind SQL Injection Date: 2016-06-14 Exploit Author: Mormoroth Exploit Author Blog: http://ha.cker.ir Vendor Homepage: http://www.dokeos.com/ Software Link: http://jaist.dl.sourceforge.net/project/dokeos/dokeos-2.1.1.zip...

Dokeos 2.2.1 - Blind SQL Injection

Exploit Title: Dokeos Blind SQL Injection Date: 2016-06-14 Exploit Author: Mormoroth Exploit Author Blog: http://ha.cker.ir Vendor Homepage: http://www.dokeos.com/ Software Link: http://jaist.dl.sourceforge.net/project/dokeos/dokeos-2.1.1.zip Version: 2.2.1 Tested on: Ubuntu Twitter :...

Hikvision(海康威视) /data/fetchPlanStatus.php 参数rows 时间盲注

No description provided by source...

SQL Blind Betting Vulnerability in zzcms

ZZCMS highlights the investment and supply and demand functions, you can quickly build a product investment website. SQL injection vulnerability exists in zzcms product/project version, cookie and time-based blind injection. The vulnerability trigger point is in downfile.php, the attacker can use...