This exploit allows an attacker to execute arbitrary commands on the target server by creating a backdoor file on the webserver. The exploit targets the JaxUltraBB v2.0 forum software.
ZENworks Patch Management is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. It should be noted these vulnerabilities can only be exploited if a non-privileged account has been created. Only an administrator can create such an account.
The Search Enhanced module for is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
gCards is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
Multiple Techno Dreams scripts are prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation could result in a compromise of the applications, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
The Info-DB application is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
Mantis is prone to a remote and local file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary remote and local PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.
This module exploits a flaw in the nwfs.sys driver to overwrite data in kernel space. The corruption occurs while handling ioctl requests with code 0x1438BB, where a 0x00000009 dword is written to an arbitrary address. An entry within the HalDispatchTable is overwritten in order to execute arbitrary code when NtQueryIntervalProfile is called. The module has been tested successfully on Windows XP SP3 with Novell Client 4.91 SP4.
An attacker might execute arbitrary SQL commands on the database server with this vulnerability. User tainted data is used when creating the database query that will be executed on the database management system (DBMS). An attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating system depending on the query, DBMS and configuration.
This exploit takes advantage of a buffer overflow vulnerability in AudioCoder 0.8.22. By sending a specially crafted payload, an attacker can trigger a buffer overflow and potentially execute arbitrary code.
Services By CQR