SQL Injection Vulnerability in the userId Parameter of Hi-Read Media's Digital Newspaper System

Joyful Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. The product has a SQL injection vulnerability, the vulnerability URL is: index.php?mod=admin&con=subscribe&act=unsubscribe&subsId=31&userId=880&paperscn=%B8%D6%CC%FA%C2%AF%C1%CF&papersen=gtll, the...

Digital Campus 2.0 Platform数字校园平台 /Code/Common/UpdateOnLine.aspx 文件 UserID 参数 SQL注入漏洞

No description provided by source...

Mymps v5.0 /wap/index.php 参数userid存在SQL注入

No description provided by source...

JPORTAL资源整合SQL注射漏洞

简要描述： JPORTAL资源整合SQL注射漏洞 详细说明： 突然发现大汉网络的JPORTAL资源整合系统在一般应用里面，SO... 我来了 文件路径： /pertoolsubsite/read/favoajaxforgen.jsp 部分代码为： else if"DO".equalsopr if !type.equals"11"||url.trim.length==0||paperTitle.trim.length==0 out.clear; out.print"false"; return; ArrayList list =...

用友NC-IUFO系统通用SQL注入(三)

简要描述： ... 详细说明： 该系统“忘记密码”模块存在sql注入漏洞 链接地址为：/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234 说明：输入用户名和邮箱后提交，程序会提交给 /epp/core（可从抓取的数据包中看到）， 漏洞参数：userid 数据库系统：oracle 注入类型：AND/OR time-based blind 这里直接给出证明案例（列出数据库实例名称即可、不深入）： 0x01; http://nc.xhlbdc.com/epp/ POST /epp/core HTTP/1.1 Host: nc.xhlbdc.co...

Sql injection

Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the 1 sectionID parameter to admin/managersection.php, 2 userID parameter to admin/edituser.php, 3 username parameter to admin/admin.php, or 4 title parameter to...

OvBB 0.x profile.php userid Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15566/info OvBB is prone to multiple SQL injection vulnerabilities. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit...

PHP Gift Registry 1.5.5 - SQL Injection

No description provided by source. Exploit Title: PHP Gift Registry 1.5.5 SQL Injection Date: 02/22/12 Author: G13 Software Link: https://sourceforge.net/projects/phpgiftreg/ Version: 1.5.5 Category: webapps php Vulnerability The userid parameter in the users.php file is vulnerable to SQL...

Stack overflow

Stack-based buffer overflow in Easy File Sharing EFS Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp...

CVE-2014-3791

Stack-based buffer overflow in Easy File Sharing EFS Web Server 6.8 allows remote attackers to execute arbitrary code via a long string in a cookie UserID parameter to vfolder.ghp...

CVE-2014-3791

CVE-2014-3791 affects Easy File Sharing Web Server (EFS) Web Server, with a stack-based buffer overflow in the SESSIONID cookie handling (UserID) in vfolder.ghp, enabling remote code execution. The Red Hat entry reiterates the same description for EFS Web Server 6.8. Exploitation details are not ...

UBUNTU-CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

CVE-2013-5674

badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid...

CVE-2012-5919

Multiple cross-site scripting XSS vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 find or 2 replace fields to havalite/findReplace.php; 3 username parameter to havalite/havalogin.php, 4 the Edit Article module, or 5 havapost.ph...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 find or 2 replace fields to havalite/findReplace.php; 3 username parameter to havalite/havalogin.php, 4 the Edit Article module, or 5 havapost.ph...

Sql injection

SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter...

CVE-2011-5234

SQL injection vulnerability in user.php in Social Network Community 2 allows remote attackers to execute arbitrary SQL commands via the userId parameter...

ECShop 2.7.2 API 盲注漏洞

简要描述： 该漏洞已经过本人测试存在。在服务器关闭魔法引号的情况下可以盲注，不受ECShop内核过滤影响。这次不坑爹了 问题文件在/api/client/api.php 利用方法为POST 详细说明： /api/client/api.php 第7行 dispatch$POST; /api/client/includes/libapi.php 6 -10 行 $funcarr = array'GetDomain', 'UserLogin', 'AddCategory', 'AddBrand', 'AddGoods', 'GetCategory', 'GetBrand', 'GetGoods...

JE CMS 1.0.0 universal password to log in with the injection vulnerability-vulnerability warning-the black bar safety net

JE CMS = 1.0.0 program appeared two vulnerabilities, one in the login authentication can be using Universal password bypass. Another isSQL injectionvulnerabilities. 1. Bypass Authentication by SQL Injection Vulnerability //login validation vulnerability in administrator\login.php page, lines...