It is possible for an attacker to create a race condition that will cause an access violation and result in a hard crash of the browser. One way to trigger this issue is by taking a decent sized html file and loading a dom call within some nested divs that will cause part of the page currently being rendered to be deleted. If the page has not loaded by the time the dom call is made then we can delete objects that have yet to be referenced, which will result in a crash as soon as the browser tries to reference the deleted object.
PHPXMLRPC is vulnerable to a very high risk remote php code execution vulnerability that may allow for an attacker to compromise a vulnerable webserver. The vulnerability is the result of unsanatized data being passed directly into an eval() call in the parseRequest() function of the XMLRPC server.
PEAR XML_RPC is vulnerable to a very high risk php code injection vulnerability due to unsanatized data being passed into an eval() call.
XOOPS is a very popular dynamic web content management system written in Object Oriented PHP. One of the features of XOOPS is it's own XMLRPC server that handles incoming XMLRPC requests. This particular feature is vulnerable to a highly critical SQL Injection issue. Additionally there are several cross site scripting issues in XOOPS as well which could allow for theft of user data or client side code execution in the context of the victim's web browser. There are a number of cross site scripting issues in the XOOPS content management software. As I mentioned earlier XOOPS comes with it's own XMLRPC server which is enabled by default and is named xmlrpc.php The problem with XMLRPC in xoops is lack of sanitation, but because the data is recieved from the reserved $HTTP_RAW_POST_DATA variable magic_quotes_gpc are never applied! This is a big problem and makes every allowable RPC method in the XOOPS XMLRPC server vulnerable to SQL injection.
There is a serious security issue in peercast versions 0.1211 and earlier that may allow for an attacker to execute arbitrary code on the remote target with the privileges of the user running peercast (usually administrator) or crash the vulnerable server. There is an updated version of peercast available and all users should upgrade as soon as possible. There is a very dangerous format string issue in peercast that may allow for an attacker to execute arbitrary code on the remote target with the privileges of the user running peercast or crash the vulnerable server. Below is an example of how this vulnerability can be exploited to crash a vulnerable server.
Burning Board is a popular, multi purpose forum / community software offered by WoltLab GmbH. There is an SQL Injection vulnerability in Burning Board 2.* and earlier that allows for an attacker to influence SQL Queries and possibly query arbitrary data from the database, such as admin password hashes. The vulnerability lies in the verify_email() function, where the $email variable is never really sanitized. An attacker can pass an email address like 'sre464hfrgt6@4g546ufgfrh5.org' to bypass the regular expression check.
Invision Power Board (IPB) is a professional forum system that has been built from the ground up with speed and security in mind. It is used by a great many people all over the world. All versions of Invision Power Board are vulnerable to a serious SQL Injection vulnerability. An attacker does not have to be logged in, or even have access or permission to view the forums in order to exploit this vulnerability. It is possible for an attacker to conduct Cross Site Scripting attacks in all versions of invision power board prior to the recently released 2.0.4. This vulnerability exists due to data submitted to the 'highlite' parameter not being sanatized properly when displaying search results. The same issue also exists in 'sources/topics.php'. The only condition is that the data sent to the 'highlite' parameter must be double hex encoded data in order to bypass the global sanatation methods. I have discovered a serious SQL Injection issue in Invision Power Board that affects most all versions of Invision Power Board regardless of most server configurations.
azbb is a forum that was written with a primary focus on security. azbb does not require a database such as MySQL, PostGres or MSSQL and can even be used as a blog, or portal of sorts. Unfortunately there are a number of security issues in AZBB versions prior to 1.0.08, but none of these issues are considered 'high risk'. However, the developer has addressed these issues and all users should upgrade to the current 1.0.08 version. These vulnerabilities include file enumeration, arbitrary file deletion, and file inclusion issues. There is an issue in AZBB that could allow for an attacker logged in as an admin, or a malicious admin to delete arbitrary files outside the scope of the application. The vulnerable code is in admin_avatar.php and admin_attachment.php. There is a file inclusion vulnerability in AZBB 1.0.07a - 1.0.07c that is the result of missing code that is present in all of the other AZBB versions. This file inclusion issue poses a different risk level depending on your server configuration.
ReviewPost is prone to cross site scripting in several different scripts throughout the application. There are a couple of SQL Injection vulnerabilities in ReviewPost. Some are easy to exploit, others are not so easy. This issue can be very dangerous as it allows a user to upload php scripts and other files.
PhotoPost Classifieds is prone to cross site scripting in several different scripts throughout the application. Examples include http://path/showcat.php?si=[XSS], http://path/reportproduct.php?report=[XSS], and http://path/contact.php?contact=[INT]&productid=[INT][XSS]. This can be used to render hostile code in the context of the victims browser, or to steal cookie based credentials or other sensitive info. Additionally, there are a substantial number of SQL Injection vulnerabilities in this application. Examples include http://path/showproduct.php?product=[INT][SQL], http://path/contact.php?contact=[INT]&productid=[INT][SQL], http://path/addfav.php?product=[INT][SQL]&do=add, http://path/showproduct.php?product=[INT]&sort=[INT][SQL]&cat=[INT], http://path/showcat.php?cat=[INT][SQL], http://path/index.php?cat=[INT][SQL], and http://path/comments.php?product=[INT]&cedit=[INT][SQL]. These SQL issues can possibly be exploited to influence SQL queries and disclose arbitrary data.
Services By CQR