258 matches found
webSPELL 4.01.02 - Multiple SQL Injections
!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV3 print "\n \'/ "; print "\n -.- "; print "\n -------------------oOO------OOo--------------------"; print "\n | webSPELL "; print "\n! Example: perl ws.pl 127.0.0.1 /webspell/ -0 -id 1"; print "\n! Targets:"; print "\n -0 Bug in...
webSPELL <= 4.01.02 Multiple Remote SQL Injection Exploit
Exploit for unknown platform in category web applications ========================================================= webSPELL "; print "\n! Example: perl ws.pl 127.0.0.1 /webspell/ -0 -id 1"; print "\n! Targets:"; print "\n -0 Bug in awards.php line 207, inject code in $awardID"; print "\n -1 Bug...
CVE-2007-1163
Affected software/module: webSPELL 4.01.02 and earlier; vulnerable file: printview.php. Vulnerability: SQL injection via the topic parameter that allows remote attackers to execute arbitrary SQL commands. This reflects the same issue described across the CVE-2007-1163 entries, using a different v...
CVE-2007-1163
SQL injection vulnerability in printview.php in webSPELL 4.01.02 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2007-1019, CVE-2006-5388, and CVE-2006-4783...
CVE-2007-1160
webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a wsauth cookie, a different vulnerability than CVE-2006-4782...
CVE-2007-1160: Improper Authentication
webSPELL 4.0, and possibly later versions, allows remote attackers to bypass authentication via a wsauth cookie, a different vulnerability than CVE-2006-4782...
CVE-2007-1160
CVE-2007-1160 describes an authentication bypass in webSPELL 4.0 and possibly later versions, where remote attackers can bypass login via a ws_auth cookie. The issue is confirmed across multiple sources (NVD entry and Prio/NVD mirrors) and is characterized as a cookie-based bypass vulnerability t...
CVE-2007-1163: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in printview.php in webSPELL 4.01.02 and earlier allows remote attackers to execute arbitrary SQL commands via the topic parameter, a different vector than CVE-2007-1019, CVE-2006-5388, and CVE-2006-4783...
webSPELL <= v4.01.02 (topic) Remote SQL Injection
No description provided by source. !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV2 print "\n \'/ "; print "\n -.- "; print "\n -------------------oOO------OOo-------------------"; print "\n | webSPELL = v4.01.02 topic Remote SQL Injection |"; print "\n | coded by DNX |"; print "\n...
CVE-2007-1154
CVE-2007-1154 is a SQL injection vulnerability in webSPELL exploited via the ws_auth cookie. The affected component is the webSPELL web software; root cause is improper handling of cookie data leading to arbitrary SQL execution, enabling remote attackers to run arbitrary SQL commands. Services or...
CVE-2007-1154
SQL injection vulnerability in webSPELL allows remote attackers to execute arbitrary SQL commands via a wsauth cookie, a different vulnerability than CVE-2006-4782...
CVE-2007-1155
The CVE-2007-1155 entry applies to webSPELL with an unrestricted file upload vulnerability that lets remote authenticated administrators upload and execute arbitrary PHP code via the add squad feature. The root cause is unrestricted upload of PHP files, enabling potential remote code execution. T...
CVE-2007-1155
Unrestricted file upload vulnerability in webSPELL allows remote authenticated administrators to upload and execute arbitrary PHP code via the add squad feature. NOTE: this issue may be an administrative feature, in which case this CVE may be REJECTED...
CVE-2007-1155: Improper Input Validation
Unrestricted file upload vulnerability in webSPELL allows remote authenticated administrators to upload and execute arbitrary PHP code via the add squad feature. NOTE: this issue may be an administrative feature, in which case this CVE may be REJECTED...
CVE-2007-1154: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in webSPELL allows remote attackers to execute arbitrary SQL commands via a wsauth cookie, a different vulnerability than CVE-2006-4782...
webspell-sql.txt
!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV2 print "\n \'/ "; print "\n -.- "; print "\n -------------------oOO------OOo-------------------"; print "\n | webSPELL "; print "\n! Example: perl ws.pl 127.0.0.1 /webspell/ -tid 1 -uid 2 -t myuser"; print "\n! Options:"; print "\n -ti...
webspell40-multi.txt
WebSpell Authentication Bypass and arbitrary code execution Vendor : WebSpell URL : http://www.webspell.org/ Version : All Risk : SQL Injection, unchecked file upload Description: webSPELL is a free Content Management System CMS for clans and gaming communities, providing all needed features like...
WebSpell > 4.0 Authentication Bypass and arbitrary code execution
WebSpell Authentication Bypass and arbitrary code execution Vendor : WebSpell URL : http://www.webspell.org/ Version : All Risk : SQL Injection, unchecked file upload Description: webSPELL is a free Content Management System CMS for clans and gaming communities, providing all needed features like...
webSPELL <= 4.01.02 (topic) Remote SQL Injection Exploit
No description provided by source. !/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV2 print " \'/ "; print " -.- "; print " -------------------oOO------OOo-------------------"; print " | webSPELL = v4.01.02 topic Remote SQL Injection |"; print " | coded by DNX |"; print "...
CVE-2007-1019
SQL injection vulnerability in news.php in webSPELL 4.01.02, when registerglobals is enabled, allows remote attackers to execute arbitrary SQL commands via the showonly parameter to index.php, a different vector than CVE-2006-5388...