1412 matches found
CVE-2023-2053: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, has been found in Campcodes Advanced Online Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/candidatesrow.php. The manipulation of the argument id leads to sql injection. The attack may be launched...
Campcodes Advanced Online Voting System SQLę³Øå „ę¼ę“
Campcodes Advanced Online Voting System is an online voting system. Campcodes Advanced Online Voting System v1.0 is vulnerable to SQL injection. The vulnerability stems from the lack of validation of external input SQL statements in the parameter id of the file /admin/ballotup.php, which can be...
Campcodes Advanced Online Voting System SQLę³Øå „ę¼ę“
Campcodes Advanced Online Voting System is an online voting system. Campcodes Advanced Online Voting System v1.0 is vulnerable to SQL injection. The vulnerability stems from the lack of validation of external input SQL statements in the parameter voter of the file login.php, which can be exploite...
PT-2023-17454 Ā· Campcodes Ā· Campcodes Advanced Online Voting System
Name of the Vulnerable Software and Affected Versions: Campcodes Advanced Online Voting System version 1.0 Description: A critical issue was found in the system, affecting the file /admin/positions delete.php. The manipulation of the id argument leads to SQL injection. It is possible to initiate...
CVE-2023-2051: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/positionsrow.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been...
CVE-2023-2054: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. This affects an unknown part of the file /admin/positionsdelete.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit...
CVE-2023-2047: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Advanced Online Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument voter leads to sql injection. The attack may be launched remotely. The exploit has been...
CVE-2023-2055: Improper Neutralization of Input During Web Page Generation
A vulnerability has been found in Campcodes Advanced Online Voting System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/configsave.php. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. The...
CVE-2023-2050: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/positionsadd.php. The manipulation of the argument description leads to sql injection. The attack may be initiated remotely. The...
CVE-2023-2052: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in Campcodes Advanced Online Voting System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ballotdown.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The explo...
CVE-2023-2049: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ballotup.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has be...
Campcodes Advanced Online Voting System SQLę³Øå „ę¼ę“
Campcodes Advanced Online Voting System is an online voting system. A SQL injection vulnerability exists in Campcodes Advanced Online Voting System v1.0. The vulnerability stems from the lack of validation of external input SQL statements in the parameter id of the file /admin/positionsdelete.php...
CVE-2023-2048: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/votersrow.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has...
In ReraiseETHCrowdfund, contributors can bypass the maxContribution limit when disableContributingForExistingCard = false.
Lines of code Vulnerability details Impact ReraiseETHCrowdfund checks the maxContribution limit for each party card in claim and claimMultiple. But this limitation can be bypassed if contributors add the voting power to the existing party card. Proof of Concept When we check claim and...
VetoProposal.voteToVeto() checks the proposal status wrongly.
Lines of code Vulnerability details Impact VetoProposal.voteToVeto wouldn't work as expected because voters can vote during the Voting status only. Proof of Concept When we check veto, it works during 3 statuses, Voting, Passed, Ready which is mentioned in the comment as well. ProposalStatus stat...
ReraiseETHCrowdfund.sol: Multiple scenarios how pending votes might not be claimable which is a complete loss of funds for a user
Lines of code Vulnerability details Impact This issue is about how the ReraiseETHCrowdfund claim functionality can be broken. When the claim functionality is broken this means that a user cannot claim his voting power, resulting in a complete loss of funds. The claim functionality is not broken i...
ETHCrowdfundBase.sol: totalVotingPower is increased too much in the _finalize function
Lines of code Vulnerability details Impact This issue is about how the ETHCrowdfundBase.finalize functions calls PartyGovernanceNFT.increaseTotalVotingPower with an amount that does not reflect the sum of the individual users' voting power. Thereby it will become impossible to reach unanimous...
ReraiseETHCrowdfund.sol: party card transfer can be front-run by claiming pending voting power which results in a loss of the voting power
Lines of code Vulnerability details Impact In this report I show how an attacker can abuse the fact that anyone can call ReraiseETHCrowdfund.claim for any user and add voting power to an existing party card. The result can be a griefing attack whereby the victim loses voting power. In some cases...
PartyGovernanceNFT.sol: burn function does not reduce totalVotingPower making it impossible to reach unanimous votes
Lines of code Vulnerability details Impact With the new version of the Party protocol the PartyGovernanceNFT.burn function has been introduced. This function is used to burn party cards. According to the sponsor the initial purpose of this function was to enable the InitialETHCrowdfund contract t...
voting-station.net Cross Site Scripting vulnerability OBB-3253294
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...