CVE-2007-0527

SQL injection vulnerability in the isremembered function in class.login.php in Website Baker 2.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the REMEMBERKEY cookie parameter. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in the isremembered function in class.login.php in Website Baker 2.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the REMEMBERKEY cookie parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-0527

SQL injection vulnerability in the isremembered function in class.login.php in Website Baker 2.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the REMEMBERKEY cookie parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-0527

CVE-2007-0527 covers a SQL injection in Website Baker 2.6.5 and earlier. The is_remembered function in framework/class.login.php uses the REMEMBER_KEY cookie directly in SQL queries, enabling authenticated? no, remote attackers to manipulate the database. The vulnerability is triggered via the RE...

SQL Injection by using Cookie Poisoning for Website Baker Version 2.6.5 and before

Website Baker Version 2.6.5 and before contains a SQL injection. This can be exploited by using Cookie Poisoning Manufacturer was notified, but want to ignore the request pending release version 3.0 Poison the cookie for the login page with the REMEMBERKEY variable with a standard sql injection '...

Website Baker REMEMBER_KEY Cookie SQL Injection

The remote host is running Website Baker, a PHP-based content management system. The installed version of Website Baker fails to validate input to the 'REMEMBERKEY' cookie before using it in 'framework/class.login.php' to construct SQL queries. Provided PHP's 'magicquotesgpc' setting is disabled,...

[SA20081] Website Baker "display_name" Script Insertion Vulnerability

TITLE: Website Baker "displayname" Script Insertion Vulnerability SECUNIA ADVISORY ID: SA20081 VERIFY ADVISORY: http://secunia.com/advisories/20081/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: Website Baker 2.x http://secunia.com/product/5455/ DESCRIPTION:...

Cross site scripting

Cross-site scripting XSS vulnerability in Website Baker CMS before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2006-2307

Cross-site scripting XSS vulnerability in Website Baker CMS before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2006-2307

Cross-site scripting XSS vulnerability in Website Baker CMS before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2006-2307

CVE-2006-2307 describes a cross-site scripting (XSS) vulnerability in Website Baker CMS prior to 2.6.4. The issue allows remote attackers to inject arbitrary web script or HTML via a user display name. The provided connected documents confirm the vendor/product and the vulnerable version range, a...

Website Baker Admin Login SQL Injection

The remote host is running Website Baker, a PHP-based content management system. The installed version of Website Baker fails to validate user input to the username parameter of the 'admin/login/index.php' script before using it to generate database queries. An unauthenticated attacker can levera...

wbaker_260_xpl.txt

Website Baker Login bypass - remote code execution software: site: http://www.websitebaker.org/2/home/ description: "Website Baker 2, the Open Source Content Management System designed to enable users to produce websites with ease." if magicquotesgpc off you can bypass admin login check and grant...

CVE-2005-4140

SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter, as used by the user field...

CVE-2005-4140

SQL injection vulnerability in admin/login/index.php in Website Baker 2.6.0 allows remote attackers to execute arbitrary SQL commands via the username parameter, as used by the user field...

CVE-2005-4140

Website Baker 2.6.0 is vulnerable to SQL injection in admin/login/index.php via the username parameter used in user-field queries. The vulnerability can allow an unauthenticated attacker to bypass authentication, disclose sensitive information, modify data, or mount further database attacks. Affe...

Website Baker <=2.6.0 SQL Injection -> Login bypass -> remote code execution

Website Baker =2.6.0 SQL Injection - Login bypass - remote code execution software: site: http://www.websitebaker.org/2/home/ description: "Website Baker 2, the Open Source Content Management System designed to enable users to produce websites with ease." if magicquotesgpc off you can bypass admi...

Website Baker 2.6.0 - Authentication Bypass / Remote Code Execution

this works with magicquotesgpc off usage: launch from Apache, fill in requested fields, then go! Sun Tzu: "The control of a large force is the same principle as the control of a few men: it is merely a question of dividing up their numbers." errorreporting0; iniset"maxexecutiontime",0;...

Website Baker 2.6.0 - Authentication Bypass Remote Code Execution

Website Baker 2.6.0 - Authentication Bypass Remote Code Execution this works with magicquotesgpc off usage: launch from Apache, fill in requested fields, then go! Sun Tzu: "The control of a large force is the same principle as the control of a few men: it is merely a question of dividing up their...

Website Baker <= 2.6.0 Login Bypass / Remote Code Execution Exploit

Exploit for unknown platform in category web applications =================================================================== Website Baker this works with magicquotesgpc off usage: launch from Apache, fill in requested fields, then go! Sun Tzu: "The control of a large force is the same principle...