Menu

Search for hundreds of thousands of exploits

"E-Xoops 1.0.5/1.0.8 - '/adresses/ratefile.php?lid' SQL Injection"

Author

Exploit author

Lostmon

Platform

Exploit platform

php

Release date

Exploit published date

2007-12-10

Download file

1
2
3
4
5
6
7
source: https://www.securityfocus.com/bid/26796/info
 
E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/e-xoops/modules/adresses/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201
Release Date Title Type Platform Author
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting" webapps multiple "Parshwa Bhavsar"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Tailor Management System 1.0 - Unrestricted File Upload to Remote Code Execution" webapps php "Saeed Bala Ahmed"
Release Date Title Type Platform Author
2012-03-28 "Apple Safari 5.1.5 For Windows - 'window.open()' URI Spoofing" remote windows Lostmon
2010-08-19 "Flock Browser 3.0.0 - Malformed Bookmark HTML Injection" remote multiple Lostmon
2010-08-04 "K-Meleon 1.x - URI Handling Multiple Denial of Service Vulnerabilities" dos windows Lostmon
2009-10-29 "Wowd - 'index.html' Multiple Cross-Site Scripting Vulnerabilities" webapps php Lostmon
2009-06-28 "Google Chrome 2.0.172 - 'About:blank' Address Bar URI Spoofing 'About:blank' Address Bar URI Spoofing" remote multiple Lostmon
2009-01-27 "Apple Safari For Windows 3.2.1 - URI Remote Denial of Service" dos windows Lostmon
2008-11-04 "DHCart 3.84 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities" webapps php Lostmon
2008-08-25 "Bluemoon inc. PopnupBlog 3.30 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php Lostmon
2008-08-15 "PHPizabi 0.848b C1 HP3 - 'id' Local File Inclusion" webapps php Lostmon
2008-08-09 "Yogurt Social Network 3.2 rc1 Module for XOOPS - 'album.php?uid' Cross-Site Scripting" webapps php Lostmon
2008-08-09 "RMSOFT Downloads Plus - '/(rmdp) 1.5/1.7 Module for XOOPS search.php?key' Cross-Site Scripting" webapps php Lostmon
2008-08-09 "RMSOFT Downloads Plus - '/(rmdp) 1.5/1.7 Module for XOOPS down.php?id' Cross-Site Scripting" webapps php Lostmon
2008-08-09 "Yogurt Social Network 3.2 rc1 Module for XOOPS - 'seutubo.php?uid' Cross-Site Scripting" webapps php Lostmon
2008-08-09 "Yogurt Social Network 3.2 rc1 Module for XOOPS - 'index.php?uid' Cross-Site Scripting" webapps php Lostmon
2008-08-09 "Yogurt Social Network 3.2 rc1 Module for XOOPS - 'scrapbook.php?uid' Cross-Site Scripting" webapps php Lostmon
2008-08-09 "Yogurt Social Network 3.2 rc1 Module for XOOPS - 'tribes.php?uid' Cross-Site Scripting" webapps php Lostmon
2008-08-09 "RMSOFT MiniShop 1.0 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities" webapps php Lostmon
2008-08-09 "Yogurt Social Network 3.2 rc1 Module for XOOPS - 'friends.php?uid' Cross-Site Scripting" webapps php Lostmon
2008-08-06 "Kshop 2.22 - 'kshop_search.php' Cross-Site Scripting" webapps php Lostmon
2008-05-19 "bcoos 1.0.13 - 'file' Local File Inclusion" webapps php Lostmon
2008-02-04 "DevTracker Module For bcoos 1.1.11 and E-xoops 1.0.8 - Multiple Cross-Site Scripting Vulnerabilities" webapps php Lostmon
2007-12-29 "PHCDownload 1.1 - 'search.php?string' Cross-Site Scripting" webapps php Lostmon
2007-12-29 "PHCDownload 1.1 - 'search.php?string' SQL Injection" webapps php Lostmon
2007-12-10 "E-Xoops 1.0.5/1.0.8 - '/modules/arcade/index.php?gid' SQL Injection" webapps php Lostmon
2007-12-10 "E-Xoops 1.0.5/1.0.8 - '/myalbum/ratephoto.php?lid' SQL Injection" webapps php Lostmon
2007-12-10 "E-Xoops 1.0.5/1.0.8 - '/mylinks/ratelink.php?lid' SQL Injection" webapps php Lostmon
2007-12-10 "E-Xoops 1.0.5/1.0.8 - '/modules/banners/click.php?bid' SQL Injection" webapps php Lostmon
2007-12-10 "E-Xoops 1.0.5/1.0.8 - '/adresses/ratefile.php?lid' SQL Injection" webapps php Lostmon
2007-12-10 "E-Xoops 1.0.5/1.0.8 - '/mysections/ratefile.php?lid' SQL Injection" webapps php Lostmon
2007-12-10 "E-Xoops 1.0.5/1.0.8 - '/mydownloads/ratefile.php?lid' SQL Injection" webapps php Lostmon 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected