ajchat-sql.txt

---- AJchat Remote Sql Injection using unset bug ... ITDefence.ru Antichat.ru AJchat Remote Sql Injection using unset bug Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007...

AJchat 0.10 - 'unse' SQL Injection

---- AJchat Remote Sql Injection using unset bug ... ITDefence.ru Antichat.ru AJchat Remote Sql Injection using unset bug Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007...

Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-320-1)

The phpinfo PHP function did not properly sanitize long strings. A remote attacker could use this to perform cross-site scripting attacks against sites that have publicly-available PHP scripts that call phpinfo. Please note that it is not recommended to publicly expose phpinfo. CVE-2006-0996 An...

httpd mod_status XSS

Cross-site scripting XSS vulnerability in modstatus.c in the modstatus module in Apache HTTP Server httpd, when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browser...

PHP Hash表覆盖任意代码执行漏洞

PHP是一款广泛使用的WEB开发脚本语言。 PHP SESSION unset存在问题，远程攻击者可利用此漏洞以应用程序权限执行任意指令。 因为不包含会话全局中的内部指针，会话扩展不正确设置会话变量的引用计数值。可导致unset SESSION和HTTPSESSIONVAR会破坏包含会话数据的HASH表，虽然会话扩展仍旧包含内部指针指向，并内部仍旧使用它。通过特殊构建的字符串可替代HASH表导致任意代码执行。 PHP PHP 5.1.6 PHP PHP 5.1.5 PHP PHP 5.1.4 PHP PHP 5.1.3 PHP PHP 5.1.3 PHP PHP 5.1.2 PHP PH...

PHP 4.4.55.2.1 - _SESSION unset() Local Overflow

PHP 4.4.55.2.1 - SESSION unset Local Overflow ?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the...

PHP < 4.4.5/5.2.1 - '_SESSION unset()' Local Overflow

?php //////////////////////////////////////////////////////////////////////// // // // | || | | | | | | | || || \ // // | |/ || '|/ |/ -| ' \ / -/ |||| /| || / // // ||||,||| ,|||||||,| || |||||| // // // // Proof of concept code from the Hardened-PHP Project // // C Copyright 2007 Stefan...

PHP < 4.4.5 / 5.2.1 _SESSION unset() Local Exploit

Exploit for linux platform in category local exploits ================================================== PHP 4.4.5 / 5.2.1 SESSION unset Local Exploit ================================================== ?php //////////////////////////////////////////////////////////////////////// // // // | || | |...

PHP variables unset use after free vulnerability

There is no access counters for SESSION and HTTPSESSIONVARS variables, making it possible to trigger use-after-free conditions by unsetting these variables. In addition, it's possible to deserealize these variables...

CVE-2007-1484

The arrayuserkeycompare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zvaldtor, which triggers memory corruption and allows local users to bypass safemode and execute arbitrary code via a certain unset operation after arrayuserkeycompare has been called...

vBulletin 3.6.4 - 'inlinemod.php?postids' SQL Injection

input-cleanarraygpc'p', array 'postids' = TYPESTR, ; $postids = explode',', $vbulletin-GPC'postids'; foreach $pos...

CVE-2006-6966

phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a config.php file via the pictures parameter to...

CVE-2006-6966

phpGraphy before 0.9.13a does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by uploading a config.php file via the pictures parameter to...

phpMyAdmin多个CSRF漏洞

phpMyAdmin是一款流行的基于web的管理MySQL数据库程序。 phpMyAdmin存在跨站请求伪造问题，远程攻击者可以利用漏洞利用CSRF攻击诱使phpMyAdmin用户在目标数据库服务器上执行任意sql查询。 phpMyAdmin使用在用户会话中存储随机token来保护跨站请求伪造，CSRF意思是web站点诱使浏览用户浏览器针对其他站点发送http请求。在phpMyAdmin中的CSRF意味着其他站点可以诱使phpMyAdmin用户的浏览器发送任意sql查询到自身的数据库。 phpMyAdmin由于如下问题而可导致绕过CSRF的保护： --Token验证：...

WoltLab Burning Board Lite wbb_userid Parameter PHP Unset SQL Injection

The remote version of Burning Board Lite fails to sanitize input to the 'wbbuserid' parameter before using it in a database query. Provided PHP's 'registerglobals' setting is enabled and 'magicquotesgpc' setting is disabled, an unauthenticated attacker may be able to leverage this issue to uncove...

CVE-2006-5116

Multiple cross-site request forgery CSRF vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by 1 directly setting a token in the URL though dynamic variable evaluation and 2 unsetting arbitrary variables via the REQUEST array,...

CVE-2006-5116

Multiple cross-site request forgery CSRF vulnerabilities in phpMyAdmin before 2.9.1-rc1 allow remote attackers to perform unauthorized actions as another user by 1 directly setting a token in the URL though dynamic variable evaluation and 2 unsetting arbitrary variables via the REQUEST array,...

papooCMS.txt

It makes use of the unset vulnerability, cms can be found at papoo.de !/usr/bin/perl require LWP::UserAgent; print "PAPOO CMS REMOTE FILE INCLUSION VULNERABILITY \n"; print "Exploit & vulnerability by Ironfist\n"; print " http://iron.gimyweb.de \n"; print "Host?"; $host = ; chomp $host; print "Pa...

CVE-2006-4466

Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to have an unspecified impact. NOTE: it could be argued that this vulnerability is due to a bug in t...

CVE-2006-4466

Joomla! before 1.0.11 does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to have an unspecified impact. NOTE: it could be argued that this vulnerability is due to a bug in t...