213 matches found
YaBB 1.x/9.1.2000 Administrator Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/11214/info It is reported that YaBB is affected by an administrator command execution vulnerability. This issue is due to a failure of the application to properly validate access to administrative commands. This issue...
YaBB 9.11.2000 search.pl Arbitrary Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1921/info YaBB Yet Another Bulletin Board is a popular perl-based bulletin board scripting package. search. pl, one of several perl scripts which comprise YaBB, fails to properly validate user input which arguments a call...
YaBB 1 Gold - SP 1 YaBB.pl Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6272/info A cross-site scripting vulnerability has been reported in the YaBB forum. This vulnerability is due to insufficient sanitization of URI parameters in some scripts. As a result, it is possible for a remote attack...
YaBB 9.1.2000 Arbitrary File Read Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1668/info YaBB.pl, a web-based bulletin board script, stores board postings in numbered text files. The numbered file name is specified in the call to YaBB.pl in the variable num=file. Before retrieving the file, YaBB wil...
YaBB 2.0 - Remote UsersRecentPosts Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/12756/info A remote cross-site scripting vulnerability affects YaBB. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content. A...
YABB SE 1.5.1 - Multiple Cross-Site Scripting Vulnerabilites
No description provided by source. source: http://www.securityfocus.com/bid/9873/info It has been reported that YaBB and YaBB SE are prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the applications to properly validate URI supplied user input. Attacker...
YABB SE 0.8/1.4/1.5 Packages.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6663/info YaBB SE allows remote users to influence the location of included files. A remote attacker may exploit this condition to cause an external, attacker-supplied file to be included and executed by YABB SE. This may...
YaBB SE <= 1.5.5 - Remote Command Execution Exploit
No description provided by source. !/usr/bin/perl YaBB SE version = 1.5.5 commands execution exploit by RST/GHC GUI version = THIS IS UNPUBLISHED RST/GHC EXPLOIT CODE KEEP IT PRIVATE coded by 1dt.w0lf http://rst.void.ru http://ghc.ru use Tk; use Tk::Menu; use LWP::UserAgent; $top = MainWindow-new...
YaBB SE Cookie安全绕过漏洞
YaBB SE是一款基于PHP的论坛程序。 YaBB SE存在COOKIE验证绕过问题，远程攻击者可以利用漏洞未授权访问应用程序。 攻击者可以使用特殊构建的值作为COOKIE信息，以任意用户身份访问应用程序，并以WEB权限执行任意命令。 YaBB SE YaBB SE 1.5.5 b YaBB SE YaBB SE 1.5.5 YaBB SE YaBB SE 1.5.4 YaBB SE YaBB SE 1.5.3 YaBB SE YaBB SE 1.5.2 YaBB SE YaBB SE 1.5.1 YaBB SE YaBB SE 1.5 .1 RC1 YaBB SE YaBB SE 1...
yabb155-exec.txt
!/usr/bin/perl YaBB SE version new; $top-title"r57yabbse155ceGUI"; $top-resizable0,0; $url = 'http://server/forum/index.php'; $id = '1'; $cookiename = 'YaBBSE155'; $cmd = 'ls -la; id; uname -a;'; $button1text = 'Found admin ID'; $foundadminid = \ $stop = 0; $xpl = LWP::UserAgent-new or die;...
YaBB SE <= 1.5.5 Remote Command Execution Exploit
No description provided by source. !/usr/bin/perl YaBB SE version = 1.5.5 commands execution exploit by RST/GHC GUI version = THIS IS UNPUBLISHED RST/GHC EXPLOIT CODE KEEP IT PRIVATE coded by 1dt.w0lf http://rst.void.ru http://ghc.ru use Tk; use Tk::Menu; use LWP::UserAgent; $top = MainWindow-new...
YaBB SE Cookie Authentication Bypass
The remote host is running YaBB SE, a web-based forum written in PHP. The version of YaBB SE installed on the remote host allows use of a cookie to bypass authentication. A remote attacker can leverage this issue using a specially crafted value for the cookie to gain access as any user, including...
YaBB SE <= 1.5.5 Remote Command Execution Exploit
Exploit for unknown platform in category web applications ================================================= YaBB SE new; $top-title"r57yabbse155ceGUI"; $top-resizable0,0; $url = 'http://server/forum/index.php'; $id = '1'; $cookiename = 'YaBBSE155'; $cmd = 'ls -la; id; uname -a;'; $button1text =...
YaBB SE 1.5.5 - Remote Command Execution
YaBB SE 1.5.5 - Remote Command Execution !/usr/bin/perl YaBB SE version new; $top-title"r57yabbse155ceGUI"; $top-resizable0,0; $url = 'http://server/forum/index.php'; $id = '1'; $cookiename = 'YaBBSE155'; $cmd = 'ls -la; id; uname -a;'; $button1text = 'Found admin ID'; $foundadminid = \ $stop = 0...
YaBB SE 1.5.5 - Remote Command Execution
!/usr/bin/perl YaBB SE version new; $top-title"r57yabbse155ceGUI"; $top-resizable0,0; $url = 'http://server/forum/index.php'; $id = '1'; $cookiename = 'YaBBSE155'; $cmd = 'ls -la; id; uname -a;'; $button1text = 'Found admin ID'; $foundadminid = \ $stop = 0; $xpl = LWP::UserAgent-new or die;...
CVE-2004-2754
SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the IDMEMBER parameter to the 1 recentTopics and 2 welcome functions...
CVE-2004-2754
This CVE concerns a SQL injection in YaBB SE (v1.5.4, 1.5.3, and potentially older before 1.5.5) via the ID_MEMBER parameter to the recentTopics and welcome functions, allowing remote SQL commands. Affected software is YaBB SE; root cause is improper input handling in SSI.php. Impact per sources ...
CVE-2002-2296
The CVE-2002-2296 entry describes a Cross-site scripting (XSS) vulnerability in YaBB.pl used by Yet Another Bulletin Board (YaBB) 1 Gold SP 1 . The flaw allows remote attackers to inject arbitrary web script or HTML through the num parameter . The available connected documents reiterate this desc...
CVE-2002-2296
Cross-site scripting XSS vulnerability in YaBB.pl in Yet Another Bulletin Board YaBB 1 Gold SP 1 allows remote attackers to inject arbitrary web script or HTML via the num parameter...
CVE-2007-3295
Directory traversal vulnerability in Yet another Bulletin Board YaBB 2.1 and earlier allows remote authenticated users to execute arbitrary Perl code via a .. dot dot in the userlanguage profile setting, which sets the userlanguage key of the member hash, and is propagated to the language variabl...