Monthly Archive: May 2009

SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Home Business Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. Date published : 2009-05-01...

SQL injection vulnerability in directory.php in Sites for Scripts (SFS) EZ Hosting Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. Date published : 2009-05-01 http://www.securityfocus.com/bid/32021...

SQL injection vulnerability in directory.php in Sites for Scripts (SFS) Gaming Directory allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. Date published : 2009-05-01 http://www.securityfocus.com/bid/32021 https://www.exploit-db.com/exploits/6894

SQL injection vulnerability in directory.php in Scripts for Sites (SFS) SFS EZ Affiliate allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a list action. Date published : 2009-05-01 https://www.exploit-db.com/exploits/6911...

SQL injection vulnerability in the Sarkilar module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a showcontent action to modules.php. Date published : 2009-05-01 http://www.securityfocus.com/bid/31830 http://packetstormsecurity.org/0810-exploits/phpnukesarkilar-sql.txt

SQL injection vulnerability in viewfaqs.php in Scripts for Sites (SFS) EZ Auction allows remote attackers to execute arbitrary SQL commands via the cat parameter. Date published : 2009-05-01 http://www.securityfocus.com/bid/32036 https://www.exploit-db.com/exploits/6918

Multiple SQL injection vulnerabilities in MyPHP Forum 3.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a confirm action, the (2) user parameter in a newconfirm...

SQL injection vulnerability in viewcomments.php in Scripts For Sites (SFS) EZ Hot or Not allows remote attackers to execute arbitrary SQL commands via the phid parameter. Date published : 2009-05-01 https://www.exploit-db.com/exploits/6914 http://osvdb.org/49540

HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption, SMS consumption, and connectivity loss) via a flood of vCards to UDP port 9204. Date published...

Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php via the adminEMail parameter to SaveConfig.php. Date published : 2009-05-01 https://www.exploit-db.com/exploits/8317 https://exchange.xforce.ibmcloud.com/vulnerabilities/50390

GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file that contains a certain large btChunkLen value. Date published : 2009-05-01 http://www.securityfocus.com/bid/34586 https://www.exploit-db.com/exploits/8466

Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the file parameter to (1) ki_makepic.php and (2) ki_nojsdisplayimage.php in...

SQL injection vulnerability in ajaxp_backend.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the page parameter. Date published : 2009-05-01 http://www.securityfocus.com/bid/34338 https://www.exploit-db.com/exploits/8341

SQL injection vulnerability in the xforum_validateUser function in Common.php in X-Forum 0.6.2 allows remote attackers to execute arbitrary SQL commands, as demonstrated via the cookie_username parameter to Configure.php. Date published : 2009-05-01 http://www.securityfocus.com/bid/34302 https://www.exploit-db.com/exploits/8317