VBZoom 1.0/1.1 - Multiple SQL Injections

source: https://www.securityfocus.com/bid/18403/info VBZooM is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. A successful exploit could allow an attacker to compromise...

Sql injection

SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729...

CVE-2006-1132

SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729...

CVE-2006-1133

CVE-2006-1133 concerns vbZoom/VBZooM 1.11, where cross-site scripting (XSS) is possible via the UserID parameter passed to comment.php or contact.php. The vulnerability is described as multiple XSS flaws, enabling remote attackers to inject arbitrary script/html. The record notes that the profile...

CVE-2005-4729

CVE-2005-4729 describes an SQL injection in VBZooM Forum, in show.php via the SubjectID parameter. This allows remote execution of arbitrary SQL commands against the application. Connected records also reference the same subject (e.g., CVE-2006-1132 notes the MainID vector and confirms SubjectID ...

CVE-2006-1133

Multiple cross-site scripting XSS vulnerabilities in vbzoom 1.11 allow remote attackers to inject arbitrary web script or HTML via the UserID parameter to 1 comment.php or 2 contact.php. NOTE: the profile.php/UserName vector is already covered by CVE-2005-2441...

CVE-2006-1132

SQL injection vulnerability in show.php in vbzoom 1.11 allow remote attackers to execute arbitrary SQL commands via the MainID parameter. NOTE: the SubjectID vector is already covered by CVE-2005-4729...

CVE-2006-1132

CVE-2006-1132 : SQL injection in vbzoom 1.11 shown via the parameter MainID in show.php. Root cause: unsanitized input enabling remote SQL commands. The SubjectID vector is noted as covered by CVE-2005-4729. No exploitation details or patch/remediation are provided in the connected documents.

vbzoomv1.11.txt

Software: vbzoom v1.11 Web Site:http://www.vbzoom.com Versions: V1.11 == SQL Injection == http://www.victem.com/vz/show.php?UserID=1&MainID=1&SubjectID=SQL http://www.victem.com/vz/show.php?UserID=1&MainID=SQL&SubjectID=1 ==== XSS ==== http://www.victem.com/vz/comment.php?UserID='XSS...

SQL injection & XSS IN vbzoom v1.11

Software: vbzoom v1.11 Web Site:http://www.vbzoom.com Versions: V1.11 == SQL Injection == http://www.victem.com/vz/show.php?UserID=1&MainID=1&SubjectID=SQL http://www.victem.com/vz/show.php?UserID=1&MainID=SQL&SubjectID=1 ==== XSS ==== http://www.victem.com/vz/comment.php?UserID='XSS...

VBZooM Forum 1.11 - contact.php?UserID Cross-Site Scripting

VBZooM Forum 1.11 - contact.php?UserID Cross-Site Scripting source: https://www.securityfocus.com/bid/16956/info VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

VBZooM Forum 1.11 - 'contact.php?UserID' Cross-Site Scripting

source: https://www.securityfocus.com/bid/16956/info VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to have arbitrary script code...

VBZoom Forum 1.11 - 'show.php' MainID SQL Injection

source: https://www.securityfocus.com/bid/16955/info VBZooM Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could allow an attacker to compromise t...

VBZoom Forum 1.11 - show.php MainID SQL Injection

VBZoom Forum 1.11 - show.php MainID SQL Injection source: https://www.securityfocus.com/bid/16955/info VBZooM Forum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful...

VBZooM Forum 1.11 - comment.php?UserID Cross-Site Scripting

VBZooM Forum 1.11 - comment.php?UserID Cross-Site Scripting source: https://www.securityfocus.com/bid/16956/info VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may...

CVE-2005-4729

SQL injection vulnerability in show.php in VBZooM Forum allows remote attackers to execute arbitrary SQL commands via the SubjectID parameter...

CVE-2005-2441

Multiple cross-site scripting XSS vulnerabilities in VBzoom allow remote attackers to inject arbitrary web script and HTML via the 1 UserName parameter to profile.php or 2 UserID parameter to login.php...

CVE-2005-2441

CVE-2005-2441 describes cross-site scripting (XSS) vulnerabilities in VBzoom. The issue affects VBzoom version 1.11, allowing remote attackers to inject arbitrary web script or HTML via the (1) UserName parameter to profile.php or (2) UserID parameter to login.php. The connected documents confirm...

CVE-2005-2441

Multiple cross-site scripting XSS vulnerabilities in VBzoom allow remote attackers to inject arbitrary web script and HTML via the 1 UserName parameter to profile.php or 2 UserID parameter to login.php...

VBZoom 1.01.11 - login.php?UserID Cross-Site Scripting

VBZoom 1.01.11 - login.php?UserID Cross-Site Scripting source: https://www.securityfocus.com/bid/14423/info VBZooM Forum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may levera...