OpenRat is a free Web Content-Management-System. A vulnerability exists in OpenRat <= 0.8-beta4 which allows a remote attacker to include arbitrary files from local or external resources. This is due to the 'tpl_dir' parameter in 'themes/default/include/html/insert.inc.php' script not properly sanitized before being used to include files.
CJ Ultra Plus is vulnerable to a SQL injection vulnerability in the SID cookie. An attacker can exploit this vulnerability to extract the admin hash from the settings table.
Fez software versions 1.3 and 2.0 RC1 are vulnerable to SQL injection. An attacker can exploit this vulnerability by sending a specially crafted SQL query to the vulnerable list.php page. This can allow the attacker to gain access to sensitive information such as version, database, and user information.
A vulnerability exists in basebuilder version 2.0.1 and prior. The vulnerability is due to the 'src/main.inc.php' script not properly sanitizing user-supplied input to the 'mj_config[src_path]' parameter. This can be exploited to include arbitrary files from remote locations by passing a URL in the 'mj_config[src_path]' parameter.
Using DHCP as a method of attack, arbitrary and malicious scripting can be injected into the DHCP administrative and logs pages (if enabled). When the web administration toold is accessed, the code injection will execute with administrative privileges, which could lead to a complete compromise of the system.
MyBlog is an open source Blog/CMS project. It allows begginers to have a simple to use blog/cms and it will still please developers with feature packed system with plugins, themes and modules. You can alter cookies to get admin privileges. If you try to enter http://blog/admin you obtain: 'Please Login' and the cookie is some likes that: login=Pepelux; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926. But if you change the cookie and put, for example: admin=yes; login=admin; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926. Then you obtain complete access to the admin panel. Exploit: javascript:document.cookie = "admin=yes; login=admin".
A vulnerability in OpenElec <= v3.01 allows an attacker to include arbitrary files on the server via the 'obj' parameter in the 'form.php' script. The vulnerability is caused due to the 'form.php' script not properly sanitizing user-supplied input to the 'obj' parameter.
This exploit is used to gain access to the user and password of a WSN Links Free 4.0.34P website. The exploit uses a blind SQL injection technique to gain access to the user and password. The exploit is done by sending a series of requests to the website with different parameters and checking the response. If the response is correct, the exploit will continue to the next step. The exploit will then use a brute force technique to gain access to the user and password.
A vulnerability exists in WCMS: Web Content Management System version v.1.0b, which allows an attacker to remotely inject malicious SQL commands. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing malicious SQL commands to the vulnerable application. This can allow the attacker to gain access to sensitive information such as usernames and passwords.
A SQL injection vulnerability exists in BuzzyWall version 1.3.1. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable application. This can allow the attacker to gain access to sensitive information such as login credentials, user data, etc. The vulnerability is due to the application not properly sanitizing user-supplied input.
Services By CQR