Ultimate Locator SQL Injection

Exploit Title: Ultimate Locator SQL Injection Vulnerability Author: Robert Cooper Robert.Cooper at areyousecure.net Software Link: http://www.ultimatelocator.com/ Dork: "Powered by Ultimate Locator" Tested on: Linux/Windows 7 Vulnerable File: resultslist.php Vulnerable parameter: radius= PoC:...

jbShop SQL Injection

Exploit Title: jbShop - e107 v7 CMS plugin - SQL Injection vulnerability Author: Robert Cooper adminatwebsiteauditing.org Software Link: http://sourceforge.net/projects/jbshop/ Tested on: Linux/Windows 7 Vulnerable Parameter: itemid= PoC:...

CanadianISP.ca SQL Injection

Title: ====== Canadian ISP Website - SQL Injection Vulnerability Date: ===== 2011-09-23 VL-ID: ===== 282 Reference: ========== http://www.vulnerability-lab.com/getcontent.php?id=282 Introduction: ============= Canadianisp.ca - Is a wholly owned project of Marc Bissonnette / InternAlysis. It was...

Omnidocs plurality of defect and repair-vulnerability warning-the black bar safety net

Title: Multiple Vulnerability in "Omnidocs" Author: Sohil Garg www.2cto.com Download address: Affected versions: All Test platform: Apache-Coyote/1.1 CVE : CVE-2 0 1 1-3 6 4 5 "Omnidocs" multiple defects PRODUCT DESCRIPTION: OmniDocs is an Enterprise Document Management EDM platform for creating,...

Cross-site scripting cookie theft

Added: 03/09/2010 Background Many web sites include scripts , which are lists of commands which, when executed in sequence, provide some enhancement to a web page. Web browsers are able to recognize scripts in web pages by the tag and handle them accordingly. Problem By sending an HTTP request...

TFTgallery .13 - Directory Traversal

Released information about the album parameter being vulnerable to XSS earlier. Seems there are other similar issues: The album parameter is vulnerable to directory transversal http://example.com/tftgallery/index.php?album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fboot.ini%00&page=1 The...

QuickTeam 2.2 SQL Injection

| D R U N K E N | || || || D A N I S H | || || |' R E D N E C K S '--''--''--' RESEARCH AND FUCKING HACKING: | DRUNKEN DANISH REDNECKS | || || || !!!!!!! | || || |' [email protected] '--''--''--' = QUICKTEAM 2.2 SQL INJECTION WE STEEL YOUR DAMNED CREDITCARDS HEHEHEEHEH | | "title"...

Escon SupportPortal Pro 3.0 - 'tid' Blind SQL Injection

Autor : OzX Sitio : Foro.Undersecurity.net Cms : Escon SupportPortal Pro Version : 3.0 Sitio: http://www.e-supportportal.com Tipo Vulnz : Blind Sql Injection Archivo : forum.php Parametro Vulnerable 1 : cat Parametro Vulnerable 2 : tid Source Vulnz forum.php: 60 - if$REQUEST"a"=="rss" 61 -...

DSECRG-08-010.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-010 Application: VHD Web Pack 2.0 Versions Affected: VHD Web Pack 2.0 Vendor URL: http://www.divideconcept.net/index.php?page=vhdwebpack/index.php Bugs: Local File Include Exploits: YES Reported: 28.01.2008 Vendor response: NONE Date of...

PHP ZLink 'go.php' SQL注入漏洞

PHP ZLink是一款基于PHP的WEB应用程序。 PHP ZLink不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'go.php'脚本对用户提交的WEB参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Zeak.net PHP ZLink 0.3 目前没有解决方案提供： http://www.zeak.net/ !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV3 print "\n \'/...

PT-2006-6264 · Adobe · Php Sdk

Name of the Vulnerable Software and Affected Versions: Adobe PHP SDK affected versions not specified Description: A remote file inclusion issue in the Adobe PHP SDK allows remote attackers to execute arbitrary PHP code via the AMFPHP BASE parameter in the CachedGateway.php file. This issue has be...

Guestex Guestbook 1.00 (email) Remote Code Execution Exploit

Exploit for unknown platform in category web applications ============================================================ Guestex Guestbook 1.00 email Remote Code Execution Exploit ============================================================ Creator: K-sPecial xzziroz.net of .aware awarenetwork.org...

MS Windows Plug-and-Play (Umpnpmgr.dll) DoS Exploit (MS05-047) (2)

Exploit for unknown platform in category dos / poc ================================================================== MS Windows Plug-and-Play Umpnpmgr.dll DoS Exploit MS05-047 2 ================================================================== // tested and approved /str0ke / Program: Denial of...

[Full-disclosure] Oracle Workflow CSS Vulnerability wf_route

Dear FD-Reader, The Oracle Critical Patch Update October 2005 provides fixes for 2 Cross-Site- Scripting vulnerabilities in Oracle Workflow found by Red-Database-Security GmbH. I know that the severity and impact of CSS bugs is low. My critical security bugs in Oracle e.g. become DBA via the impo...