The Blind SQL injection vulnerability has been found and confirmed within the software as an anonymous user. A successful attack could allow an anonymous attacker to access information such as username and password hashes that are stored in the database. The following URL and parameter has been confirmed to suffer from blind SQL injection: POST /wordpress/wp-content/plugins/sp-client-document-manager/ajax.php?function=email-vendor HTTP/1.1 Host: server User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0 Accept: text/html, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Referer: http://server/wordpress/?page_id=16 Cookie: wordpress_cbbb3ecca6306be6e41d05424d417f7b=test1%7C1414550777%7CxKIQf1812x9lfyhuFgNQQhmDtojDdEnDTfLisVHwnJ6%7Cc493b6c21a4a1916e2bc6076600939af5276b6feb09d06ecc043c37bd92a0748; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_cbbb3ecca6306be6e41d05424d417f7b=test1%7C1414550777%7CxKIQf1812x9lfyhuFgNQQhmDtojDdEnDTfLisVHwnJ6%7C7995fe13b1bbe0761cb05258e4e13b20b27cc9cedf3bc337440672353309e8a3; bp-activity-oldestpage=1 Connection: keep-alive Content-Length: 33 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 vendor_email[]=<SQL Injection>
getfile.php is accessible to everyone. is_admin() is used to check priveleges but because this code is run in context of wp-admin/admin-ajax.php this function always evalute to true. $_SERVER['REQUEST_URI'] is not escaped.
MINIX is prone to denial of service in the TCP/IP stack (/service/inet) by sending a single TCP packet with a malformed TCP option. A TCP option with length of zero would cause inet to end up in an infinite loop.
Snowfox CMS suffers from a cross-site request forgery vulnerabilities. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.
A vulnerability exists in the KNOX security component of the Samsung Galaxy firmware that allows a remote webpage to install an APK with arbitrary permissions by abusing the 'smdm://' protocol handler registered by the KNOX component. The vulnerability has been confirmed in the Samsung Galaxy S4, S5, Note 3, and Ace 4.
It is possible to inject SQL code in the variables 'id' and 'action' on the pages group, photos and user. This bug was found using the portal with authentication. To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact with the application. Has been detected a reflected XSS vulnerability in Zoph, that allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser.
It is possible to inject SQL code in the variable 'id' on the page 'modify.php'. This bug was found using the portal without authentication. To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact with the application. Has been detected a reflected XSS vulnerability in WebsiteBaker, that allows the execution of arbitrary HTML/script code to be executed in the context of the victim user's browser. An input validation problem exists within WebsiteBaker which allows injecting CR (carriage return - %0D or ) and LF (line feed - %0A or ) characters into the server HTTP response header, resulting in a HTTP Response Splitting Vulnerability.
The described vulnerability allows any unauthenticated user to edit the CWMP configuration. Exploitation can be performed by LAN users or through the Internet if the router is configured to expose the web interface to WAN. Also because the router lacks of CSRF protection, malicious JS code can be deployed in order to exploit the vulnerability through a malicious web page.
A vulnerability in Maarch LetterBox 2.8 allows an attacker to bypass authentication by manipulating the UserId cookie. An attacker can set the UserId cookie to a value of 'username' ' or ' which will bypass authentication and allow access to the admin panel. This can be done by either manually editing the cookie or by using a JavaScript injection.
The latest version of MyBB forums (1.8.2) is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this vulnerability by creating a user account and going to User CP > Edit Profile > Custom User Title and entering a malicious vector such as <img src=x onerror=alert('XSS');>. When a user visits the calendar page, the XSS alert box will be triggered.
Services By CQR