Gallarific (user.php) Arbirary Change Admin Information Exploit

Exploit for unknown platform in category web applications =============================================================== Gallarific user.php Arbirary Change Admin Information Exploit =============================================================== gallarific exploit change password Founder : Emai...

Gallarific - 'user.php' Arbirary Change Admin Information

gallarific exploit change password Founder : Email: Script: HOME hhttp://www.gallarific.com/ Note:after change password go to login in control admin panel : font si...

Sql injection

SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via the ordersn parameter in an orderquery action...

CVE-2009-1622

SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via the ordersn parameter in an orderquery action...

CVE-2009-1622

CVE-2009-1622 affects EcShop 2.5.0, where the order_query action in user.php is vulnerable to SQL injection via the order_sn parameter. Remote attackers could potentially execute arbitrary SQL commands due to insufficient input validation. The connected sources (NVD and CVE records) confirm the a...

CVE-2009-1622: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in user.php in EcShop 2.5.0 allows remote attackers to execute arbitrary SQL commands via the ordersn parameter in an orderquery action...

CVE-2009-1489

includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter...

CVE-2009-1489

includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter...

CVE-2009-1489: Improper Authentication

includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter...

ECShop 2.5.0 (order_sn) Remote SQL Injection Vulnerability

ecshop2.5.0 user.php存在sql注入漏洞 user.php 2176行： else if $action == 'orderquery' $ordersn = empty$GET'ordersn' ? '' : trimsubstr$GET'ordersn', 1; includeonceROOTPATH .'includes/clsjson.php'; $json = new JSON; $result = array'error'=0, 'message'='', 'content'=''; ifisset$SESSION'lastorderquery' iftim...

CVE-2008-6394: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in core/user.php in CS-Cart 1.3.5 and earlier allows remote attackers to execute arbitrary SQL commands via the cscookiescustomeruserid cookie parameter...

CS-Cart 'core/user.php' SQL注入漏洞

BUGTRAQ ID: 30979 CNCAN ID：CNCAN-2008090301 CS-Cart是一款基于PHP的WEB应用程序。 CS-Cart不正确处理用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，可能获得敏感信息或操作数据库。 问题由于'core/user.php'脚本对用户提交给WEB参数缺少过滤，构建恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 CS-Cart 1.3.5 可联系供应商获得补丁信息： http://www.cs-cart.com/...

CS-Cart <= 1.3.5 SQL Injection

GulfTech Security Research September 02, 2008 Vendor : CS-Cart.com URL : http://www.cs-cart.com/ Version : CS-Cart = 1.3.5 Risk : SQL Injection Description: CS-Cart Cart is a full featured online ecommerce application written in php that allows users to build, run and promote an online store. The...

Multiple vulnerabilities in Envolution

Здравствуйте 3APA3A! Сообщаю вам о найденных мною многочисленных уязвимостях в системе Envolution, в частности Insuficient Anti-automation и Cross-Site Scripting. Insuficient Anti-automation: Уязвимость в user.php в модуле NS-NewUser...

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection

Pligg CMS 9.9.0 - Cross-Site Scripting Local File Inclusion SQL Injection GulfTech Security Research July 30, 2008 Vendor : Pligg LLC URL : http://www.pligg.com/ Version : Pligg alertdocument.cookie; The above example link would display the end users cookie to them. Of course this can also be use...

Vulnerabilities in PostNuke Phoenix

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Insufficient Anti-automation и Cross-Site Scripting уязвимостях в PostNuke Phoenix. Insufficient Anti-automation: Уязвимость в user.php в модуле NS-NewUser...

Unfixed XSS vulnerability at www.iauq.ac.ir

Security researcher MK, has submitted on 13/07/2008 a cross-site-scripting XSS vulnerability affecting www.iauq.ac.ir, which at the time of submission ranked 886585 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 08/07/2009. It is currently...

Sql injection

Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user'language' variable, probably related to SQL injection...

CVE-2008-3070

Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user'language' variable, probably related to SQL injection...

CVE-2008-3070: Improper Neutralization of Special Elements used in an SQL Command

Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user'language' variable, probably related to SQL injection...