WordPress cformsII插件rs和rsargs参数脚本注入漏洞

BUGTRAQ ID: 44587 CVE ID: CVE-2010-3977 WordPress是一款免费的论坛Blog系统。 WordPress所使用的cformsII插件没有正确的过滤用户提交给wp-content/plugins/cforms /libajax.php页面的rs和rsargs参数便显示给了用户。攻击者可以通过提交恶意的POST请求来利用这个漏洞，当用户查看生成页面时就会导致执行所注入的代码。 Nicole Stich cformsII 11.5 厂商补丁： Nicole Stich ------------...

CVE-2010-4147

Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to 1 index.php and 2 product-list.php...

Sql injection

Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to 1 index.php and 2 product-list.php...

CVE-2010-4147

Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to 1 index.php and 2 product-list.php...

MetInfo 3.0 PHP Code Injection Vulnerability

Exploit for php platform in category web applications ============================================ MetInfo 3.0 PHP Code Injection Vulnerability ============================================ Exploit Title£ºMetInfo 3.0 PHP Code Injection Vulnerability Date:2010-10-31 Author£ºlinux520.com...

PT-2010-5319

Name of the Vulnerable Software and Affected Versions Pentasoft Avactis Shopping Cart versions 1.9.1 build 8356 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved by sending a malicious User-Agent header to specific API endpoints, suc...

CVE-2010-4147: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pentasoft Avactis Shopping Cart 1.9.1 build 8356 free edition and earlier allow remote attackers to execute arbitrary SQL commands via the User-Agent header to 1 index.php and 2 product-list.php...

icblogger full-(tr) (ziyaretci.mdb) Database Disclosure Exploit

!/usr/bin/perl -w icblogger full-tr ziyaretci.mdb Database Disclosure Exploit Found & Coded: indoushka Date: 25/07/2010 Home: http://www.hack-r1z.com/cc/ Dz-Ghost Team ===== Saoucha Star08 Cyber Sec theblind74 XproratiX onurozkan n2n Meher Assel =========================== special thanks to :...

Microsoft Internet Explorer - 'Winhlp32.exe' MsgBox Code Execution (MS10-023) (Metasploit)

$Id: ms10022ievbscriptwinhlp32.rb 10504 2010-09-28 16:19:50Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Beta Asp - Anket Database Disclosure Exploit

Exploit for perl platform in category web applications ============================================ Beta Asp - Anket Database Disclosure Exploit ============================================ !/usr/bin/perl -w Beta Asp - Anket Database Disclosure Exploit Found & Coded: indoushka Date: 25/07/2010...

Microsoft Internet Explorer - Object Type (MS03-020) (Metasploit)

$Id: ms03020ieobjecttype.rb 10150 2010-08-25 20:55:37Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

PunBB <= 1.3.4 Pun_PM <= v1.2.6 Blind SQL Injection Vulnerability

Exploit for php platform in category web applications ================================================================= PunBB 526 function punpmeditmessage global $forumdb, $forumuser, $langpunpm; $errors = array; // Verify input data $query = array 'SELECT' = 'm.id as id, m.senderid as senderid,...

Re: RunCMS XSS Vulnerability via User Agent

Html tags were removed from the advisory during the submission process. Hopefully the following advisory will correct this. Title: RunCMS XSS Vulnerability via User Agent Vendor: RunCMS Product: RunCMS Tested Version: 2.1 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By:...

dotDefender 3.8-5 - Remote Code Execution (via Cross-Site Scripting)

dotDefender 3.8-5 - Remote Code Execution via Cross-Site Scripting / DotDefender = 3.8-5 No Authentication Remote Code Execution Through XSS Tested on DotDefender 3.8-5 On Ubuntu Server 9.10 64-bit with Firefox 3.6.3 Paul Hand aka rAWjAW AT offsec.com Original Post-Authentication Remote Command...

RunCMS XSS Vulnerability via User Agent

Title: RunCMS XSS Vulnerability via User Agent Vendor: RunCMS Product: RunCMS Tested Version: 2.1 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares ===== Description ===== RunCMS is prone to a XSS vulnerability by mangling the user-agent field on a http...

runcms-xss.txt

Title: RunCMS XSS Vulnerability via User Agent Vendor: RunCMS Product: RunCMS Tested Version: 2.1 Threat Class: XSS Severity: Medium Remote: yes Local: no Discovered By: Andrei Rimsa Alvares ===== Description ===== RunCMS is prone to a XSS vulnerability by mangling the user-agent field on a http...

Oxygen2PHP <= 1.1.3 (member.php) Blind SQL Injection Exploit

Exploit for php platform in category web applications ============================================================ Oxygen2PHP 'Mozilla/5.0', maxredirect = 0, cookiejar = $Cookies, or die $!; my $Get = $UserAgent-get$HostName.SQLInjection$UserName; if$Get-content = /0-91,5 : a-zA-Z0-9-.2,15 :...

Streamcast 0.9.75 - HTTP User-Agent Buffer Overflow (Metasploit)

$Id: steamcastuseragent.rb 9488 2010-06-11 16:12:05Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Internet Explorer Winhlp32.exe MsgBox Code Execution

$Id: ms10022ievbscriptwinhlp32.rb 9085 2010-04-15 16:08:27Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Design/Logic Flaw

The Standard Remember method in TikiWiki CMS/Groupware 3.x before 3.5 allows remote attackers to bypass access restrictions related to "persistent login," probably due to the generation of predictable cookies based on the IP address and User agent in userslib.php...