分類:Essays

Proverbs Web Calendar 2.1.2 XSS (Cross-site Scripting) Security Vulnerabilities

Hacker Research Topics

iStock_000007384492-keyboard_5

Proverbs Web Calendar 2.1.2 XSS (Cross-site Scripting) Security Vulnerabilities

Exploit Title: Proverbs Web Calendar /calendar.php Multiple Parameters XSS (Cross-site Scripting) Security Vulnerabilities

Vendor: Proverbs

Product: Proverbs Web Calendar

Vulnerable Versions: 1.0.0 1.1 1.2.2 2.1 2.1.2

Tested Version: 1.2.2 2.1

Advisory Publication: April 03, 2015

Latest Update: April 03, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Writer and Reporter: Wang Jing [CCRG, Nanyang Technological University (NTU), Singapore]

Suggestion Details:


(1) Vendor & Product Description:


Vendor:

Proverbs

Product & Vulnerable Versions:

Proverbs Web Calendar

1.0.0

1.1

1.2.2

2.1

2.1.2

Vendor URL:

http://www.proverbs.biz/

Download:

Proverbs Web Calendar can be obtained from here,

http://www.proverbsllc.com/demos/calendar/calendar.php

http://www.hotscripts.com/listing/proverbs-web-calendar/

http://www.c-point.com/free_php_scripts/calendar.php

http://www.html.it/articoli/proverbs-php-web-calendar-v-100-1/

Product Introduction Overview:

“This is a web event calendar developed using PHP and powered by MySQL. The calendar is viewed in month format initially with a…

View original post 詳見內文:約166字

6kbbs v8.0 XSS (Cross-site Scripting) Security Vulnerabilities

Hacker Research Topics

Security-Researchers-Discover-Java-Binary-Planting-Vulnerability

6kbbs v8.0 XSS (Cross-site Scripting) Security Vulnerabilities

Exploit Title: 6kbbs XSS (Cross-site Scripting) Security Vulnerabilities

Vendor: 6kbbs

Product: 6kbbs

Vulnerable Versions: v7.1 v8.0

Tested Version: v7.1 v8.0

Advisory Publication: April 02, 2015

Latest Update: April 02, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Writer and Reporter: Wang Jing [CCRG, Nanyang Technological University (NTU), Singapore]

Suggestion Details:

(1) Vendor & Product Description:

Vendor:

6kbbs

Product & Vulnerable Versions:

6kbbs

v7.1

v8.0

Vendor URL & download:

6kbbs can be obtained from here,

http://www.6kbbs.com/download.html

http://code.google.com/p/6kbbs/downloads/list

Product Introduction Overview:

“6kbbs V8.0 is a PHP + MySQL built using high-performance forum, has the code simple, easy to use, powerful, fast and so on. It is an excellent community forum program. The program is simple but not simple; fast, small; Interface generous and good scalability…

View original post 詳見內文:約315字

6kbbs v8.0 SQL Injection Security Vulnerabilities

Hacker Research Topics

07_phone_security_g_w

6kbbs v8.0 SQL Injection Security Vulnerabilities

Exploit Title: 6kbbs Multiple SQL Injection Security Vulnerabilities

Vendor: 6kbbs

Product: 6kbbs

Vulnerable Versions: v7.1 v8.0

Tested Version: v7.1 v8.0

Advisory Publication: April 01, 2015

Latest Update: April 01, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) [CWE-89]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

Writer and Reporter: Wang Jing [CCRG, Nanyang Technological University (NTU), Singapore]

Suggestion Details:



(1) Vendor & Product Description:



Vendor:

6kbbs

Product & Vulnerable Versions:

6kbbs

v7.1

v8.0

Vendor URL & download:

6kbbs can be obtained from here,

http://www.6kbbs.com/download.html

http://www.bvbcode.com/code/93n8as2z-down

Product Introduction Overview:

“6kbbs V8.0 is a PHP + MySQL built using high-performance forum, has the code simple, easy to use, powerful, fast and so on. It is an excellent community forum program. The program is simple but…

View original post 詳見內文:約247字

6kbbs v8.0 SQL Injection Security Vulnerabilities

Hacker Research Topics

07_phone_security_g_w

6kbbs v8.0 SQL Injection Security Vulnerabilities

Exploit Title: 6kbbs Multiple SQL Injection Security Vulnerabilities

Vendor: 6kbbs

Product: 6kbbs

Vulnerable Versions: v7.1 v8.0

Tested Version: v7.1 v8.0

Advisory Publication: April 01, 2015

Latest Update: April 01, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) [CWE-89]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

Writer and Reporter: Wang Jing [CCRG, Nanyang Technological University (NTU), Singapore]

Suggestion Details:



(1) Vendor & Product Description:



Vendor:

6kbbs

Product & Vulnerable Versions:

6kbbs

v7.1

v8.0

Vendor URL & download:

6kbbs can be obtained from here,

http://www.6kbbs.com/download.html

http://www.bvbcode.com/code/93n8as2z-down

Product Introduction Overview:

“6kbbs V8.0 is a PHP + MySQL built using high-performance forum, has the code simple, easy to use, powerful, fast and so on. It is an excellent community forum program. The program is simple but…

View original post 詳見內文:約247字

ECE Projects XSS (Cross-site Scripting) Security Vulnerabilities

Hacker Research Topics

web-security

ece_home_project

ECE Projects XSS (Cross-site Scripting) Security Vulnerabilities

Exploit Title: ECE Projects /suchergebnis/? tx_solr[q] Parameter XSS (Cross-site Scripting) Security Vulnerabilities

Vendor: ECE Projektmanagement G.m.b.H. & Co. KG (ECE)

Product: ECE Projects

Vulnerable Versions:

Tested Version:

Advisory Publication: April 01, 2015

Latest Update: April 01, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Writer and Reporter: Wang Jing [CCRG, Nanyang Technological University (NTU), Singapore]

Suggestion Details:



(1) Vendor & Product Description:

Vendor:

ECE Projektmanagement G.m.b.H. & Co. KG (ECE)

Product & Version:

All Projects – Shopping & Office, Traffic, Industries, Hotel, Residential

Vendor URL & download:

ECE Projects can be obtained from here,

http://www.ece.com/en/projects/all-projects/

Google Dork:

ECE Projektmanagement GmbH & Co. KG

Product Introduction Overview:

“ECE develops, builds, and manages large commercial properties in the business areas Shopping, Office, Traffic, and Industries…

View original post 詳見內文:約403字

724CMS 5.01 Directory (Path) Traversal Security Vulnerabilities

Computer Technology Hut

08NEncryptionKeymaster-1374242307339

724CMS 5.01 Directory (Path) Traversal Security Vulnerabilities

Exploit Title: 724CMS /section.php Module Parameter Directory Traversal Security Vulnerabilities

Vendor: 724CMS

Product: 724CMS

Vulnerable Versions: 3.01 4.01 4.59 5.01

Tested Version: 5.01

Advisory Publication: March 14, 2015

Latest Update: March 14, 2015

Vulnerability Type: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

Discover and Author: Wang Jing [CCRG, Nanyang Technological University (NTU), Singapore]

Recommendation Details:

(1) Vendor & Product Description:

Vendor:

724CMS Enterprise

Product & Vulnerable Versions:

724CMS

3.01

4.01

4.59

5.01

Vendor URL & download:

724CMS can be bargained from here,

http://724cms.com/

Product Introduction Overview:

“724CMS is a content management system (CMS) that has customers spread in Canada, Japan, Korean, the United States, European and many others. It allows publishing, editing and modifying content, organizing…

View original post 詳見內文:約287字

724CMS 5.01 Multiple SQL Injection Security Vulnerabilities

Computer Technology Hut

encrypt

724CMS 5.01 Multiple SQL Injection Security Vulnerabilities

Exploit Title: 724CMS Multiple SQL Injection Security Vulnerabilities

Vendor: 724CMS

Product: 724CMS

Vulnerable Versions: 3.01 4.01 4.59 5.01

Tested Version: 5.01

Advisory Publication: March 14, 2015

Latest Update: March 14, 2015

Vulnerability Type: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) [CWE-89]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)

Impact Subscore: 6.4

Exploitability Subscore: 10.0

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

Recommendation Details:

(1) Vendor & Product Description:

Vendor:

724CMS Enterprise

Product & Vulnerable Versions:

724CMS

3.01

4.01

4.59

5.01

Vendor URL & download:

724CMS can be gain from here,

http://724cms.com/

Product Introduction Overview:

“724CMS is a content management system (CMS) that has customers spread in Canada, Japan, Korean, the United States, European and many others. It allows publishing, editing and modifying content, organizing, deleting as…

View original post 詳見內文:約244字