CVE-2013-5704: Undefined Security Weakness

The modheaders module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."...

Магические методы, сериализация, инъекции в сессию и все-все-все

==-1== Введение Изначально писал для себя, как небольшой сборник полезных идей, в итоге вылилось вот в такую статью. Особого опыта в написании публикаций у меня нет, так что ногами не пинать, я старался Перед переходом к практическим примерам рассмотрим теоретически основы используемых функций...

Sql injection

directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $GET"s" variable from being unset. NOTE: it could be argued that this...

CVE-2008-7210: Improper Neutralization of Special Elements used in an SQL Command

directory.php in AJchat 0.10 allows remote attackers to bypass input validation and conduct SQL injection attacks via a numeric parameter with a value matching the s parameter's hash value, which prevents the associated $GET"s" variable from being unset. NOTE: it could be argued that this...

AJchat 0.10 unset() bug Remote SQL Injection Vulnerability

No description provided by source. ---- AJchat Remote Sql Injection using unset bug ... ITDefence.ru Antichat.ru AJchat Remote Sql Injection using unset bug Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / /...

AJchat 0.10 unset() bug Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ========================================================== AJchat 0.10 unset bug Remote SQL Injection Vulnerability ========================================================== ---- AJchat Remote Sql Injection using unset bug ... ITDefence.r...

AJchat 0.10 - unse SQL Injection

AJchat 0.10 - unse SQL Injection ---- AJchat Remote Sql Injection using unset bug ... ITDefence.ru Antichat.ru AJchat Remote Sql Injection using unset bug Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / /...

ajchat-sql.txt

---- AJchat Remote Sql Injection using unset bug ... ITDefence.ru Antichat.ru AJchat Remote Sql Injection using unset bug Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007...

AJchat 0.10 - 'unse' SQL Injection

---- AJchat Remote Sql Injection using unset bug ... ITDefence.ru Antichat.ru AJchat Remote Sql Injection using unset bug Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007...

Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-320-1)

The phpinfo PHP function did not properly sanitize long strings. A remote attacker could use this to perform cross-site scripting attacks against sites that have publicly-available PHP scripts that call phpinfo. Please note that it is not recommended to publicly expose phpinfo. CVE-2006-0996 An...

CVE-2007-3706: Undefined Security Weakness

The sanitizeglobals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demonstrated by a SERVER cookie...

httpd mod_status XSS

Cross-site scripting XSS vulnerability in modstatus.c in the modstatus module in Apache HTTP Server httpd, when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browser...

PHP Hash表覆盖任意代码执行漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP SESSION unset存在问题，远程攻击者可利用此漏洞以应用程序权限执行任意指令。 因为不包含会话全局中的内部指针，会话扩展不正确设置会话变量的引用计数值。可导致unset SESSION和HTTPSESSIONVAR会破坏包含会话数据的HASH表，虽然会话扩展仍旧包含内部指针指向，并内部仍旧使用它。通过特殊构建的字符串可替代HASH表导致任意代码执行。 PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PH...

PHP 4.4.55.2.1 - _SESSION unset() Local Overflow

PHP 4.4.55.2.1 - SESSION unset Local Overflow ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the...

PHP < 4.4.5/5.2.1 - '_SESSION unset()' Local Overflow

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP < 4.4.5 / 5.2.1 _SESSION unset() Local Exploit

Exploit for linux platform in category local exploits ================================================== PHP 4.4.5 / 5.2.1 SESSION unset Local Exploit ================================================== ?php //////////////////////////////////////////////////////////////////////// // // // | || | |...

PHP variables unset use after free vulnerability

There is no access counters for SESSION and HTTPSESSIONVARS variables, making it possible to trigger use-after-free conditions by unsetting these variables. In addition, it's possible to deserealize these variables...

CVE-2007-1484

The arrayuserkeycompare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zvaldtor, which triggers memory corruption and allows local users to bypass safemode and execute arbitrary code via a certain unset operation after arrayuserkeycompare has been called...

vBulletin 3.6.4 - 'inlinemod.php?postids' SQL Injection

input-cleanarraygpc'p', array 'postids' = TYPESTR, ; $postids = explode',', $vbulletin-GPC'postids'; foreach $pos...

CVE-2006-6966

phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a config.php file via the pictures parameter to...