OpenClassifieds 1.7.0.3 – Chained: Captcha Bypass / SQL Injection / Persistent Cross-Site Scripting on FrontPage
Author:Michael Brooks (Rook)
webapps
webapps 相关类别内容索引。Exploit Database / Exploits for Penetration Testers, Researchers, and Ethical Hackers。聚合漏洞利用代码、PoC 与研究资料。
Coppermine Photo Gallery 1.5.10 – ‘searchnew.php’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/45600/info
Coppermine Photo Gallery 1.5.10 – ‘help.php’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/45600/info
HotWeb Scripts HotWeb Rentals – ‘PageId’ SQL Injection
source: https://www.securityfocus.com/bid/45567/info
LiveZilla 3.2.0.2 – ‘Track’ Module ‘server.php’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/45586/info
Pligg CMS 1.1.3 – ‘range’ SQL Injection
source: https://www.securityfocus.com/bid/45578/info
Web@all 1.1 – Remote Admin Settings Change
===========================================
OpenEMR 3.2.0 – SQL Injection / Cross-Site Scripting
# Exploit Title: OpenEMR v3.2.0 Multiple Vulnerabilities
pecio CMS 2.0.5 – Cross-Site Request Forgery (Add Admin)
#Title : pecio CMS v2.0.5 > tnt-r00t
Interact 2.4.1 – SQL Injection
# Title: Interact 2.4.1 SQL Injection
CruxCMS 3.0 – Multiple Input Validation Vulnerabilities
source: https://www.securityfocus.com/bid/45594/info
LoveCMS 1.6.2 Final – Multiple Local File Inclusions
LoveCMS 1.6.2 Final Multiple Local File Inclusion Vulnerabilities
Social Engine 4.x (Music Plugin) – Arbitrary File Upload
###########################################################################
Vacation Rental Script 4.0 – Cross-Site Request Forgery
# Exploit Title: Vacation Rental Script v4.0 XSRF VULNERABILTY
Joomla! Component com_idoblog – SQL Injection
# Exploit Title: joomla com_idoblog /SQL injection Vulnerability
Traidnt Up 3.0 – Cross-Site Request Forgery
#Title : TRAIDNT UP Version 3.0 - CSRF Add Admin
openauto 1.6.3 – Multiple Vulnerabilities
Credit:Michael Brooks
Pligg CMS 1.1.2 – Blind SQL Injection / Cross-Site Scripting
Credit: Michael Brooks
CubeCart 3.0.6 – Cross-Site Request Forgery (Add Admin)
#Title : CubeCart 3.0.4 > tnt-r00t
SquareCMS 0.3.1 – ‘post.php’ SQL Injection
SquareCMS 0.3.1 (post.php) Remote SQL Injection Vulnerability
Joomla! Component com_xmovie 1.0 – Local File Inclusion
# Exploit Title: Joomla Component com_xmovie 1.0 Local File Inclusion Vulnerability
iDevSpot iDevCart 1.10 – Multiple Local File Inclusions
) ) ) ( ( ( ( ( ) )
CubeCart 3.0.4 – SQL Injection
/////////////////(())//////////////
Joomla! Component com_adsmanager – Remote File Inclusion
Joomla Component com_adsmanager Remote File Include
Joomla! Component com_ponygallery – Remote File Inclusion
Joomla Component com_ponygallery Multiple Remote File Include
IPN Development Handler 2.0 – Multiple Vulnerabilities
IPN Development Handler v2.0 CSRF (Change Admin Account)
Ypninc Realty Classifieds – SQL Injection
Script Name: Ypninc Realty Classifieds
Built2Go PHP Shopping – SQL Injection
Script Name: Built2Go PHP Shopping ( version )
D-Link WBR-1310 – Authentication Bypass
# Exploit Title: D-Link WBR-1310 Authentication Bypass Vulnerability
Social Share – ‘search’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/45566/info
MyBB 1.6 – ‘private.php?keywords’ SQL Injection
source: https://www.securityfocus.com/bid/45565/info
MyBB 1.6 – ‘search.php?keywords’ SQL Injection
source: https://www.securityfocus.com/bid/45565/info
WordPress Plugin Accept Signups 0.1 – ’email’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/45548/info
Joomla! Component Classified – SQL Injection
source: https://www.securityfocus.com/bid/45545/info
WordPress Plugin Accept Signups 0.1 – Cross-Site Scripting
# Exploit Title: WORDPRESS Plugin Accept Signups PERSISTENT XSS
Mitel AWC – Command Execution
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-14
jobappr 1.4 – Multiple Vulnerabilities
=======================================
Joomla! Component com_xgallery 1.0 – Local File Inclusion
# Exploit Title: Joomla Component com_xgallery 1.0 Local File Inclusion Vulnerability
html-edit CMS – Multiple Vulnerabilities
Vulnerability ID: HTB22734
Habari Blog – Multiple Vulnerabilities
Vulnerability ID: HTB22732
Injader CMS – Multiple Vulnerabilities
Vulnerability ID: HTB22745
Hycus CMS – Multiple Vulnerabilities
Vulnerability ID: HTB22737
S9Y Serendipity 1.5.4 – Arbitrary File Upload
In The Name Of GOD
ImpressCMS 1.2.x – ‘quicksearch_ContentContent’ HTML Injection
source: https://www.securityfocus.com/bid/45541/info
WordPress Plugin Mediatricks Viva Thumbs – Multiple Information Disclosure Vulnerabilities
source: https://www.securityfocus.com/bid/45539/info
Social Share – ‘Username’ SQL Injection
source: https://www.securityfocus.com/bid/45536/info
Habari 0.6.5 – Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/45530/info
OpenFiler – ‘device’ Cross-Site Scripting
source: https://www.securityfocus.com/bid/45523/info
FreeNAS 0.7.2.5543 – ‘index.php’ Multiple Cross-Site Scripting Vulnerabilities
source: https://www.securityfocus.com/bid/45522/info
Mafya Oyun Scrpti – ‘profil.php’ SQL Injection
source: https://www.securityfocus.com/bid/45501/info