w-CMS 2.0.1 is vulnerable to a remote code execution vulnerability due to insufficient sanitization of user-supplied input. An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application, which will allow the attacker to execute arbitrary code on the server. The vulnerable code is located in the userFunctions.php file, where the procActivity() function is called with user-supplied input. This function then writes the user-supplied input to a file, which is specified by the 'type' parameter. This allows an attacker to write arbitrary code to a file, which can then be executed on the server.
A vulnerability in DotNetNuke (DNNArticle Module) allows an attacker to inject malicious SQL commands into the application. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The vulnerability is due to insufficient sanitization of user-supplied input in the 'categoryid' parameter of the 'dnnarticlerss.aspx' script. An attacker can exploit this vulnerability to manipulate SQL queries by injecting arbitrary SQL code.
Spitefire cms is not protected from CSRF as attackers are capable of adding/editing administrators account, or ever uploading a file through CSRF. An example of changing administrator's details is given.
A CSRF vulnerability exists in Pligg CMS versions 2.0.0rc2 and prior. An attacker can create a malicious HTML page that when visited by an authenticated user, can create a file with arbitrary content on the server. The malicious HTML page contains a form with hidden fields that when submitted, will create a file with the content specified in the 'updatedfile' field. The file is created in the '/var/www/html/pligg/' directory with the name specified in the 'the_file2' field.
Following exploits can be used against any site installed 'Mac's CMS', after a successful attack a text containing 'User: yashar was added successfully. Click Here to update your view' will be appeared. There are too many XSS (Reflected and stored) in this CMS, an example is provided. Local path disclosure can be exploited by using the provided example.
KCFinder is vulnerable to Local File Disclosure vulnerability. An attacker can exploit this vulnerability by sending a specially crafted POST request to the vulnerable application. This will allow the attacker to read any file from the server.
This module exploits a buffer overflow vulnerability found in HP's StorageWorks P4000 VSA on versions prior to 10.0. The vulnerability is due to an insecure usage of the sscanf() function when parsing login requests. This module has been tested successfully on the HP VSA 9 Virtual Appliance.
The vulnerability exists due to an error when handling HTTP requests with an invalid method. A remote attacker can send a specially crafted HTTP request with an invalid method, causing the application to crash.
When using the 'addtocompare' task, the component does not correctly sanitize the 'pid' parameter before using it to construct SQL queries, making it vulnerable to SQL Injection attacks. The following proof of concept request retrieves the database user, name and version: http://example.com/index.php?tmpl=component&option=com_redshop&view=product&task=addtocompare&pid=24%22%20and%201=0%20union%20select%201,2,3,4,5,6,7,8,concat_ws%280x203a20,%20user%28%29,%20database%28%29,%20version%28%29%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63%23&cmd=add&cid=20&sid=0.6886686905513422
This plugin is vulnerable to CSRF on all forms, as well as XSS on some of them. This can be used in many different ways, like defacement of both public site and the admin area (only the HMS Testimonials plugin area will be affected), modify settings to set a lower role as moderator (very harmful on sites with open registrations), etc.
Services By CQR