ZEN Load Balancer Filelog Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "ZEN Load Balancer...

ZEN Load Balancer Filelog Command Execution

This module exploits a vulnerability in ZEN Load Balancer version 2.0 and 3.0-rc1 which could be abused to allow authenticated users to execute arbitrary code under the context of the 'root' user. The 'content2-2.cgi' file uses user controlled data from the 'filelog' parameter within backticks...

CVE-2012-2710

Cross-site scripting XSS vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb...

Cross site scripting

Cross-site scripting XSS vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb...

CVE-2012-2710

CVE-2012-2710 affects the Zen theme for Drupal (6.x-1.x) prior to 6.x-1.1. When the option “Append the content title to the end of the breadcrumb” is enabled, the breadcrumb can reflect the content title without sufficient filtering, allowing remote attackers to inject arbitrary script or HTML vi...

CVE-2012-2710

Cross-site scripting XSS vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb...

CVE-2012-1413

Cross-site scripting XSS vulnerability in zcinstall/includes/modules/pages/databasesetup/headerphp.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the dbusername parameter to zcinstall/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in zcinstall/includes/modules/pages/databasesetup/headerphp.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the dbusername parameter to zcinstall/index.php...

CVE-2012-1413

Cross-site scripting XSS vulnerability in zcinstall/includes/modules/pages/databasesetup/headerphp.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the dbusername parameter to zcinstall/index.php...

CVE-2012-1413

Zen Cart CVE-2012-1413 affects Zen Cart 1.5.0 and earlier during installation. The XSS flaw resides in zc_install/includes/modules/pages/database_setup/header_php.php, exploitable via the db_username parameter to zc_install/index.php, allowing remote script/HTML injection. No exploit details or m...

CVE-2012-1413

Cross-site scripting XSS vulnerability in zcinstall/includes/modules/pages/databasesetup/headerphp.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the dbusername parameter to zcinstall/index.php...

SA-CONTRIB-2012-082 - Zen - Cross Site Scripting

CVE: CVE-2012-2710. The Zen theme provides a configurable breadcrumb which is commonly used as an additional navigation tool for users. The theme outputs the breadcrumb, but does not provide sufficient filtering to prevent a Cross site scripting XSS attack. This vulnerability is mitigated by the...

Zen Cart 1.3.8a File Upload

File upload vulnerability in Zen Cart Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Zen Cart 1.3.9f LFI

Local file include vulnerability in Zen Cart typefilter parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Zen Cart v.1.5.0 Remote Shell Upload

Exploit for php platform in category web applications Remote Shell Upload Vulnerability DaTe : 5.3.2012 Version : 1.5.0 Tested on: Linux " Ubuntu " , "win 7" Author : Mr.ExiT OrPh4n Email : email protected Site : sh4ck.com + v99x.com Dork : "Powered by Zen Cart" Software Link:...

Zen Cart 'path_to_admin/product.php'跨站请求伪造漏洞

Bugtraq ID: 51968 CVE ID：CVE-2011-4403 Zen Cart是一款免费的购物车软件。 Zen Cart管理控制面板存在跨站请求伪造漏洞，攻击者提交特制表单，可以管理员权限删除或禁用产品等。 0 Zen Cart 1.3.9h 厂商解决方案 目前没有详细解决方案提供： http://www.zen-cart.com/ form name="products" action=" http://www.mysite.com/pathtoadmin/product.php?action=deleteproductconfirm"; method="post"...

Zen-Cart 1.3.9h Cross Site Request Forgery

Advisory Information Title: Zen-Cart Admin CSRF/XSRF - Delete / Disable Products Date published: 2012-02-10 01:59:45 AM upSploit Ref: UPS-2011-0018 CVE REF: CVE-2011-4403 Advisory Summary An attacker can force an administrator to delete or disable products from within his store. Vendor Zen-Cart...

Zen Cart 1.3.9h - '/path_to_admin/product.php' Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/51968/info Zen Cart is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also...

Zen Cart 1.3.9h - path_to_adminproduct.php Cross-Site Request Forgery

Zen Cart 1.3.9h - pathtoadminproduct.php Cross-Site Request Forgery source: https://www.securityfocus.com/bid/51968/info Zen Cart is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthoriz...

CVE-2011-4567

Cross-site scripting XSS vulnerability in includes/templates/templatedefault/templates/tplgvsenddefault.php in Zen Cart before 1.5 allows remote attackers to inject arbitrary web script or HTML via the message parameter in a gvsend action to index.php, a different vulnerability than CVE-2011-4547...