Vulnerability exists in 'Private Messages'. It depends on what code is added to the $message parameter. Persistent XSS code could be added when replying to a message. The bug is in the 'modules.php' file in the 'Private_Messages' module.
Ez Album is vulnerable to Blind SQL Injection. An attacker can exploit this vulnerability by sending malicious SQL queries to the vulnerable parameter 'id' in the 'index.php' page. This can allow the attacker to gain access to the database and execute arbitrary code.
The vulnerability is caused by the getprogname() function which is user controlled and goes to fmt2 which then gets vfprintf()ed to stderr. This results in a Format String vulnerability.
A directory traversal vulnerability exists in phpShowtime, which allows an attacker to access arbitrary files and directories outside of the web root directory. This is achieved by using a specially crafted URL containing directory traversal characters such as '../' to access files outside of the web root directory.
Snort Report version 1.3.2 is vulnerable to SQL Injection. The vulnerable parameter is 'ipAddress' and the vulnerable URL is http://server/ipdetail.php?type=dst&FQDN=&ipAddress=773116111<SQLi Here>&beginTime=0&endTime=1324665310. A proof of concept URL is http://server/ipdetail.php?type=dst&FQDN=&ipAddress=773116111%20AND%20%28SELECT%205849%20FROM%28SELECT%20COUNT%28*%29%2CCONCAT%280x3a79786a3a%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a7578713a%2CFLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29&beginTime=0&endTime=1324665310.
A Blind SQL Injection vulnerability was discovered in phux Download Manager. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. This can allow the attacker to gain access to sensitive information stored in the database.
You can upload any file you want by bypasss extesion wing headers, if you use mozilla firefox live http headers can be used for modification of the same. or naming the file but also for example as shell.php.php.php.jpg.zip
This exploit allows an attacker to inject malicious code into the 4images 1.7.6 > 9 web application. The attacker can use a form to send a malicious payload to the vulnerable application, which will then be executed on the server. The payload can be used to execute arbitrary commands on the server, allowing the attacker to gain access to sensitive information or take control of the server.
The PDF Printer Preferences ActiveX suffers from a buffer overflow vulnerability. When a large buffer is sent to the sub_path item of the StoreInRegistry function, and the sub_key item of the InitFromRegistry function, in pdfxctrl.dll module, we get a SEH overwrite. An attacker can gain access to the system of the affected node and execute arbitrary code.
This module exploits a heap overflow vulnerability in the Windows Multimedia Library (winmm.dll). The vulnerability occurs when parsing specially crafted MIDI files. Remote code execution can be achieved by using Windows Media Player's ActiveX control. Exploitation is done by supplying a specially crafted MIDI file with specific events, causing the offset calculation being higher than how much is available on the heap (0x400 allocated by WINMM!winmmAlloc), and then allowing us to either "inc al" or "dec al" a byte. This can be used to corrupt an array (CImplAry) we setup, and force the browser to confuse types from tagVARIANT objects, which leverages remote code execution under the context of the user. At this time, for IE 8 target, JRE (Java Runtime Environment) is required to bypass DEP (Data Execution Prevention). Note: Based on our testing, the vulnerability does not seem to trigger when the victim machine is operated via rdesktop.
Services By CQR