Business Survey Pro 1.0 is vulnerable to a Remote SQL Injection vulnerability. This vulnerability allows an attacker to inject malicious SQL queries into the vulnerable application. The vulnerable parameter is the 'id' parameter in the survey_results_text.php file. An attacker can exploit this vulnerability by sending a malicious SQL query to the vulnerable parameter. The malicious query can be used to extract sensitive information from the database such as usernames and passwords.
A vulnerability exists in Entertainment Portal v2.0 which allows an attacker to gain administrative access by setting a cookie. An attacker can exploit this issue by setting the 'adminLogged' cookie to 'Administrator' and then accessing the admin panel.
Software Directory v1.0 is vulnerable to both SQL Injection and Cross-Site Scripting (XSS). An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. The SQL Injection vulnerability can be exploited by sending a specially crafted HTTP request containing malicious SQL statements to the vulnerable application. The Cross-Site Scripting (XSS) vulnerability can be exploited by sending a specially crafted HTTP request containing malicious JavaScript code to the vulnerable application.
A remote SQL injection vulnerability exists in SoftComplex PHP Image Gallery (ctg). An attacker can send a specially crafted HTTP request containing malicious SQL statements to the vulnerable application in order to gain access to unauthorized data or to execute system level commands.
A vulnerability in deltascripts phpShop allows an attacker to bypass authentication by providing a username of [real_admin_name] ' or ' 1=1 and a password of ZoRLu. Generally, the admin username is 'admin'. A demo of the exploit can be found at http://demo.deltascripts.com/phpshop/admin/login.php, with the username 'admin' ' or ' 1=1 and the password ZoRLu.
A vulnerability in deltascripts phplinks allows an attacker to bypass authentication by providing a username of [real_admin_name] ' or ' 1=1 and a password of ZoRLu. Generally, the admin username is 'admin'. An example of a vulnerable URL is http://localhost/classifieds/admin/login.php. The attacker can then use the username 'admin' ' or ' 1=1 and the password ZoRLu to gain access.
A vulnerability in deltascripts phpclassifieds allows an attacker to bypass authentication by providing a username of [real_admin_name] ' or ' 1=1 and a password of ZoRLu. Generally, the admin username is 'admin'. An example of a vulnerable URL is http://localhost/classifieds/admin/login.php. An example of a vulnerable URL is http://localhost/anunturi/admin/login.php.
LoveCMS 1.6.2 Final is vulnerable to an arbitrary file delete vulnerability. This vulnerability is due to insufficient sanitization of user-supplied input to the 'delete' parameter in the 'images.php' script. An attacker can exploit this vulnerability to delete arbitrary files from the server, resulting in a loss of integrity.
Softcomplex PHP Image Gallery v1.0 is prone to an authentication-bypass vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this issue to gain unauthorized access to the application and modify data.
Directory traversal vulnerability in MySQL Quick Admin 1.5.5 allows remote attackers to read and execute arbitrary files via a .. (dot dot) in the lang parameter to actions.php. $_SESSION['language'] is set to the value of the lang parameter without any sanitization. The actions.php will send this $_SESSION['language'] value to required.php which will pass it to include() function without any sanitization. Exploit: http://[target]/[path]/actions.php?do=lang&lang=../../../../../../../../../etc/passwd%00
Services By CQR