EUVD-2008-0395

Malware in sbrugna...

Urulu connectionId参数SQL盲注漏洞

BUGTRAQ ID: 28032 CVECAN ID: CVE-2008-0385 Urulu是用PHP、JavaScript和XSL编写的内容管理系统。 Urulu处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞获取敏感信息。 如果向以下URI提交了带有畸形connectionId参数的POST请求的话： /index.php/statprt/js/request /index.php/dyn/js/request 就可能执行SQL注入攻击，导致泄露帐号口令等敏感信息；如果Urulu数据库用户拥有FILE权限的话，还可能通过MySQL的INTO...

Sql injection

SQL injection vulnerability in server/widgetallocator.php in Urulu 2.1 allows remote attackers to execute arbitrary SQL commands via the connectionId parameter to index.php with 1 statprt/js/request or 2 dyn/js/request in the PATHINFO...

CVE-2008-0385

SQL injection vulnerability in server/widgetallocator.php in Urulu 2.1 allows remote attackers to execute arbitrary SQL commands via the connectionId parameter to index.php with 1 statprt/js/request or 2 dyn/js/request in the PATHINFO...

CVE-2008-0385

Urulu 2.1 contains a SQL injection in the connectionId parameter of index.php via PATH_INFO (statprt/js/request or dyn/js/request). The vulnerability allows remote attackers to extract data from the database, with potential for arbitrary code execution if the database user has FILE privileges (e....

CVE-2008-0385

SQL injection vulnerability in server/widgetallocator.php in Urulu 2.1 allows remote attackers to execute arbitrary SQL commands via the connectionId parameter to index.php with 1 statprt/js/request or 2 dyn/js/request in the PATHINFO...

Urulu 2.1 Blind SQL Injection Vulnerability (CVE-2008-0385)

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: Urulu Vendor: USystems Subject: Blind SQL Injection Vulnerability Risk: High Author: Daniel Roethlisberger Date: 2008-02-25 CVE Name: CVE-2008-0385 Introduction ------------ An AJAX based Blind SQL Injection vulnerability exists in the Web 2....

Urulu 2.1 Blind SQL Injection Vulnerability (CVE-2008-0385)

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: Urulu Vendor: USystems Subject: Blind SQL Injection Vulnerability Risk: High Author: Daniel Roethlisberger Date: 2008-02-25 CVE Name: CVE-2008-0385 Introduction ------------ An AJAX based Blind SQL Injection vulnerability exists in the Web 2....