Pre Shopping Mall 1.0 - Remote SQL Injection Vulnerability

No description provided by source. ============================================== Pre Shopping Mall v1.0 Remote SQL Injection ============================================== Found: Cyber-Security.org ============================================== Exploit:...

XOOPS 2.0.14 Article Module - 'article.php' SQL Injection Vulnerability

No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register import re class TestPOCPOCBase: vulID = '84999' ssvid version = '1.0' author = 'kikay' vulDate = '2008-05-06' createDate ...

MaxWebPortal 1.3 pic_popular.asp SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/13466/info MaxWebPortal is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries...

MyBB HM My Country Flags - SQL Injection

No description provided by source. Exploit title: HM My Country Flags SQL Injection Author: JoinSe7en Contact: join7 +at+ riseup.net Tested on: Linux Category: Web Applications Software link: http://mods.mybb.com/view/hm-my-country-flags HM My Country Flags has a SQL Injection vulnerability. If w...

PHP Event Calendar SQL Injection

Exploit Title: PHP Event Calendar / SQL Injection Vulnerability Date: 14/04/2014 Author: Daniel Godoy Author Mail: danielgodoyatGobiernoFederaldotcom Author Web: www.delincuentedigital.com.ar Software: PHP Event Calendar Software Link: http://codecanyon.net/item/php-event-calendar/47723 Tested on...

程氏舞曲CMS最新php版本多处sql注入漏洞

简要描述： 操蛋捏。 详细说明： 昨天刚下载的，2.16号更新的版本。 第一处在管理后台：https://images.seebug.org/upload/app/controllers/admin/news.php第66行 public function so $key = $this-input-get'key';//使用get方式获取相关参数，没做处理 $user = $this-input-get'user'; $cid = $this-input-get'cid'; $page = $this-input-get'page'; ifempty$page $page=1;...

CBI arrests Indian mastermind behind Hire-a-Hacker service on FBI tip-off

For the first time in history, Indian Law Enforcement Agency 'Central Bureau of Investigation' CBI has arrested a Cyber criminal after getting a tip-off from the US Federal Bureau of Investigation FBI. 33-Year-old Amit Vikram Tiwari, son of an Indian Army colonel and an engineering dropout, who...

DomPHP 0.83 - SQL Injection

DomPHP 0.83 - SQL Injection ------------------------------------------------------------- DomPHP = v0.83 SQL Injection Vulnerability ------------------------------------------------------------- = Author : Houssamix = Script : DomPHP = v0.83 = Download : http://www.domphp.com/download/ = BUG : SQ...

iScripts Multicart SQL Injection

Iscripts multicart Multiple vulnerabilities Author : i-Hmx [email protected] sec4ever.com - Vendor have been contacted since 2 years for more than 20 times and he don't give ashit @ all :/ I.Sql Injection Vulns /getProductOptionDetailsAjax.php For Table name Post productoptionid=i-Hmx'/!1337union...

WHMCS 5.2.8 SQL Injection Vulnerability (0day)

dork:- inurl:submitticket.php site:.com inurl:submitticket.php site:.net inurl:submitticket.php site:.us inurl:submitticket.php site:.eu inurl:submitticket.php site:.org inurl:submitticket.php site:.uk intext:"Powered by WHMCompleteSolution" intext:"Powered by WHMCompleteSolution"...

MySQL: Обход фильтрации символов в имени колонок

Прим.: Вариант, который потерялся, и о котором никто не напомнил: https://rdot.org/forum/showpost.php?...2&postcount=10 Материал ниже все равно может быть полезен при изучении специфических SQL-запросов в MySQL и при некоторых типах WAF. ------------ Недавно, изучая одну уязвимость возникла...

Threat Outbreak Alert: Fake Money Transfer Notification Email Messages on September 23, 2013

Medium Alert ID: 30940 First Published: 2013 September 23 13:41 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claims to contain a money transfer notification from Western Union. The message attempts to convince the recipient to open th...

Telmanik CMS Press 1.01b - SQL Injection

Exploit for php platform in category web applications http://site.org/themes/pages.php?pagename=SQLi you have to formate you injection like so: unionselectrowfromtable Replacing spaces with ��. Ex: http://site.org/themes/pages.php?pagename=unionselectpasswordfrommembers 0day.today 2018-01-02...

Threat Outbreak Alert: Fake Online Banking Account Credential Information Email Messages on August 1, 2013

Medium Alert ID: 30276 First Published: 2013 August 1 15:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam e-mail messages that claim to contain online banking account credential information for the recipient. The text in the e-mail message attempts to...

Destoon B2B建站软件最新版SQL盲注漏洞

简要描述： Destoon B2B建站存在SQL注入漏洞（已经打了20130703补丁） 详细说明： /module/mall/buy.inc.php 这个文件，除了已经修复了的知道创宇上报的那个注入点，还存在其他注入点。 if$submit require DTROOT.'/module/'.$module.'/cart.class.php'; $do = new cart; $cart = $do-get; if$post $add = arraymap'trim', $add; $add'address' = areapos$add'areaid', ''.$add'address...

Threat Outbreak Alert: Fake Account Credential Information Email Messages on July 23, 2013

Medium Alert ID: 30182 First Published: 2013 July 23 15:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain an account credential information for the recipient. The text in the email message attempts to convince the...

Zoom X4 / X5 SQL Injection / Authentication Bypass Vulnerabilities

Zoom X4 and X5 modems suffers from authentication bypass and remote SQL injection vulnerabilities. Vulnerable Products - Zoom X4 ADSL Modem and Router running Nucleus/4.3 UPnP/1.0Virata-EmWeb/R620 Server All GS Firmware versions Zoom X5 ADSL Modem and Router running Nucleus/4.3...

PHPSHE 1.1 /module/index/product.php SQL注入漏洞

PHPSHE商城系统集合了众多的功能，并提供了简易的操作、实用的功能，快速让用户建立独立个性化的网上商店，为用户提供了一个低成本、高效率的网上商城建设方案。 但在其 v1.1版本中，程序对参数过滤不严，存在sql注入漏洞 module/index/product.php ...82行 case 'list': $categoryid = intval$id; $info = $db-peselect'category', array'categoryid'=$categoryid; //搜索 $sqlwhere = " and productstate = 1";...

Two Texas Bills Could Shape Mobile Privacy

Two bills introduced in Texas this week could refine mobile privacy in the state and tweak how law enforcement can request sensitive information from cell phones going forward. A press release from the Texas Electronic Privacy Coalition TxEPC credits Bryan Hughes, a Republican from the town of...

Anonymous threatens to Hack Obama's State of the Union broadcast

The hacktivist group Anonymous says it's planning to block all live streams of President Obama's State of the Union address Tuesday night, in an operation entitled "Operation SOTU". "We reject the State of the Union. We reject the authority of the President to sign arbitrary orders and bring...