1150 matches found
CVE-2010-1053
Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to a userlogin.php and b managerlogin.php. NOTE: some of these details are obtained...
CVE-2010-1053
CVE-2010-1053 affects Zen Time Tracking 2.2 and earlier. The vulnerability arises from multiple SQL injection flaws in login paths (userlogin.php and managerlogin.php) where the input parameters (username, password) can be exploited when magic_quotes_gpc is disabled. This allows remote attackers ...
Zen Cart local file disclosure-vulnerability warning-the black bar safety net
by t00ls Get the page path where the url/extras/ipntestreturn.php To obtain site configuration information url/extras/curltest. php? url=file://path/includes/configure.php Read the server passwd url/extras/curltest. php? url=file:///etc/passwd Get the MYSQL password, but the database only allows...
Zen Tracking 2.2 SQL Injection
Zen Tracking + Download : http://scripts.ringsworld.com/calendars/zentimetracking/ + Vuln Code : userlogin.php if !empty$POST'password' $username =$POST'username'; $password =$POST'password'; dbConnect; $result1 = mysqlquery"select from ".$tbluser." where username='". $username ."' and...
Zen Time Tracking 2.2 - Multiple SQL Injections
Zen Time Tracking 2.2 - Multiple SQL Injections source: https://www.securityfocus.com/bid/38153/info Zen Time Tracking is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could all...
Zen Tracking <= 2.2 (Auth Bypass) SQL Injection Vulnerability
No description provided by source. + Zen Tracking = 2.2 Auth Bypass SQL Injection Vulnerability + Discovered by cr4wl3r cr4wl3r!linuxmail.org + Download : http://scripts.ringsworld.com/calendars/zentimetracking/ + Vuln Code : userlogin.php if !empty$POST'password' $username =$POST'username';...
Zen Tracking 2.2 - Authentication Bypass
Zen Tracking 2.2 - Authentication Bypass + Zen Tracking + Download : http://scripts.ringsworld.com/calendars/zentimetracking/ + Vuln Code : userlogin.php if !empty$POST'password' $username =$POST'username'; $password =$POST'password'; dbConnect; $result1 = mysqlquery"select from ".$tbluser." wher...
Zen Tracking 2.2 - Authentication Bypass
Zen Tracking + Download : http://scripts.ringsworld.com/calendars/zentimetracking/ + Vuln Code : userlogin.php if !empty$POST'password' $username =$POST'username'; $password =$POST'password'; dbConnect; $result1 = mysqlquery"select from ".$tbluser." where username='". $username ."' and...
Zen Tracking <= 2.2 (Auth Bypass) SQL Injection Vulnerability
Exploit for unknown platform in category web applications ============================================================= Zen Tracking = 2.2 Auth Bypass SQL Injection Vulnerability ============================================================= + Zen Tracking = 2.2 Auth Bypass SQL Injection...
Zen Cart 'extras/curltest.php' Information Disclosure Vulnerability
Zen Cart is prone to an information-disclosure vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker can exploit this issue to view local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks are...
Zen Cart Information Disclosure Vulnerability (Dec 2009) - Active Check
Zen Cart is prone to an information disclosure vulnerability because it fails to sufficiently sanitize user-supplied data. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Design/Logic Flaw
The installation for Zen Cart stores sensitive information and insecure programs under the 1 docs, 2 extras, and 3 zcinstall folders, and 4 install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a direct request, different...
Information disclosure
extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information...
CVE-2009-4322
extras/ipntestreturn.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...
Information disclosure
extras/ipntestreturn.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message...
CVE-2009-4323
The installation for Zen Cart stores sensitive information and insecure programs under the 1 docs, 2 extras, and 3 zcinstall folders, and 4 install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a direct request, different...
CVE-2009-4321
extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information...
CVE-2009-4321
extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI. NOTE: some of these details are obtained from third party information...
CVE-2009-4321
Zen Cart CVE-2009-4321 affects extras/curltest.php in Zen Cart 1.3.8/1.3.8a (and possibly other versions), allowing remote attackers to read arbitrary local files via a file:// URI. The root cause cited is insufficient sanitization of user-supplied data, enabling information disclosure through th...
CVE-2009-4322
CVE-2009-4322 (Zen Cart) : Zen Cart installations can disclose sensitive information via a direct request to extras/ipn_test_return.php, revealing the installation path in an error message. Connected documents describe broader exposure of sensitive data and insecure files under Zen Cart folders (...