[Full-disclosure] HYSA-2006-008 myBloggie 2.1.3 CRLF & SQL Injection

TATUS: == Vendor was contacted but no response received till date. CREDITS: This vulnerability was discovered and researched by matrix_killer of  h4cky0u Security Forums. mail : matrix_k at abv.bg web : http://www.h4cky0u.org Search function sql injection wa

[Full-disclosure] HYSA-2006-007 phpmyfamily 1.4.1 CRLF injection & XSS

till date. CREDITS:==== This vulnerability was discovered and researched by matrix_killer of h4cky0u Security Forums. mail : matrix_k at abv.bg web : http://www.h4cky0u.org Co-Researcher: h4cky0u of h4cky0u Security Forums. mail : h4cky0u at gmail.com web : http://www.h4cky0u.org Greets t

[Full-disclosure] HYSA-2006-006 G-Book 1.0 XSS And Other Vulnerabilities

== - This vulnerability was discovered and researched by matrix_killer of h4cky0u Security Forums - mail : matrix_k at abv.bg web : http://www.h4cky0u.org - Co-Researcher - h4cky0u of h4cky0u Security Forums. mail : h4cky0u at gmail.com web : http://www.h4cky0u.org Greets to all omega-team members +

[Full-disclosure] !ADVISORY! + =Thu Mar 16 03:44:16 EST 2006= + Directory Transversal in Snort

= Snort had extended no explanation regarding this problem indentified. = Contact = h4cky0u [EMAIL PROTECTED] 1-888-565-9428 CISSP GSAE CSFA SSP-CNSA SSP-MPA GIPS GWAS CAP SSCP

[Full-disclosure] HYSA-2006-005 WordPress 2.0.1 Remote DoS Exploit

+ h4cky0u[h4cky0u.org], lessMX6 and all dudes from #DevilDev ;)#The exploit was tested on 10 machines but not all got flooded.Only 6/10 got crashed use Socket; if (@ARGV < 2) { &usage; } $rand=rand(10); $host = $ARGV[0];$dir = $ARGV[1]; $host =~ s/(http:\/\/)//eg; #no http://for ($

[Full-disclosure] phpBannerExchange 2.0 Directory Traversal Vulnerability

=== No fix available as of date. CREDITS: - This vulnerability was discovered and researched by - TiX of h4cky0u Security Forums. Mail : Rahigley dot 1989 at gmail dot com Web : http://www.h4cky0u.org - Co Researcher - h4cky0u of h4cky0u Security Forums. Mail : h4cky0u at gmail dot com

[Full-disclosure] HYSA-2006-003 Oi! Email Marketing 3.0 SQL Injection

licking 'Configuration' and viewing the pages source: (It's hidden by *) Password VENDOR STATUS= Vendor was contacted repeatedly but no response received till date. FIX: No fix available as of date. CREDITS: - This vulnerability was discovered and researched

Re: [Full-disclosure] Security Contact at Network Intelligence?

[EMAIL PROTECTED] - Isn't that one working for you??? On 2/23/06, Xyberpix <[EMAIL PROTECTED]> wrote: Hi All,Anyone got any contacts at Network Intelligence?I can't find shit on their site at all :-( I'm going to call them when they wake up later on as a worst case.TIAxyberpix__

Re: [Full-disclosure] Cpanel Admin login (username) Disclosure

Yup i could reproduce that with all the sites i tried it on. On 2/8/06, Sumit Siddharth <[EMAIL PROTECTED]> wrote: Hi, could somebody kindly confirm this.When a null username and a null password is provided in the cpanel administration, port 2082, (basic authorization prompt) and then cancelling th

[Full-disclosure] HYSA-2006-002 Phpclanwebsite 1.23.1 Multiple Vulnerabilities

me other page of your menu like "Home" and a windows will pop-up with your text + you will see a sql syntax error[this bug may not work on some machines]PROOF OF CONCEPT CODE: ==#!perl#Phpclanwebsite 1.23.1 SQL injection exploit by matrix_killer#Greets to all omega-team

[Full-disclosure] HYSA-2006-001 phpBB 2.0.19 search.php and profile.php DOS Vulnerability

that the db cannot understand.Proof Of Concept Code:==#!/usr/bin/perl ### ## Recoded by: mix2mix and Elioni of http://ahg-khf.org## And h4cky0u Security Forums (http://h4cky0u.org) ## Name: phpBBDoSReloaded## Original Author: HaCkZaTaN of

[Full-disclosure] Improper Character Handling In PHP Based Scripts like PhpBB, IPB etc.

Well this was after i found somebody posing as me on my site --> http://www.h4cky0u.org which was actually quite interesting and dangerous  (looking from the social engineering point of view).   Download the following file -   http://www.h4cky0u.org/poc.txt   Make sure you download it and not view

[Full-disclosure] HYSA-2005-009 Elite Forum 1.0.0.0 XSS Vulnerability

: === "Powered by Elite Forum" CREDITS: This vulnerability was discovered and researched by Gladiator.KHF (handle/username - gladiator) of h4cky0u Security Forums. mail : gleden123 at Yahoo dot Com web : http://www.h4cky0u.org ORIGINAL ADVISORY: == http://www.h

[Full-disclosure] Re: Alstrasoft Epay Pro 2.0 and prior Directory Traversal Vulnerability

The ORIGINAL ADVISORY to the whole issue could be found at -   http://h4cky0u.org/advisories/HYA-2005-008-alstrasoft-epay-pro.txt  On 9/19/05, h4cky0u <[EMAIL PROTECTED]> wrote:  -- HYA-2005-008 h4cky0u.org Adviso

[Full-disclosure] Alstrasoft Epay Pro 2.0 and prior Directory Traversal Vulnerability

eS of h4cky0u Security Forums. mail : GeMeGeMeS at Gmail.Com web : http://www.h4cky0u.org -- http://www.h4cky0u.org(In)Security at its best... ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hoste

[Full-disclosure] Subscribe Me Pro 2.044.09P and prior Directory Traversal Vulnerability (Updated)

./etc/passwd%00 VENDOR STATUS:== Vendor Contact : 13th Sep 2005Vendor Reply : 13th sep 2005 - This Vulnerability has been fixed in the Latest Release : 2.050.01P FIX: Upgrade to version 2.050.01P CREDITS: This vulnerability was discovered and researched by - ShoCK FX of h4cky0u Secu

[Full-disclosure] Subscribe Me Pro 2.044.09P and prior Directory Traversal Vulnerability

./etc/passwd%00 VENDOR STATUS:== Vendor Contact : 13th Sep 2005Vendor Reply : 13th sep 2005 - This Vulnerability has been fixed in the Latest Release : 2.050.01P FIX: Upgrade to version 2.050.01P CREDITS: This vulnerability was discovered and researched by - ShoCK FX of h4cky0u Secu

Re: [Full-disclosure] Disk Cleaning Tools

Bob,   I suggest you try out the Incinerator tool from the latest iolo's System Mechanic Professional. It erases the data on your disk securely and is quite reliable. Even Encase (one of the best forensics tools out there)  couldn't recover data erased by the incinerator. Hope this helps.   Regard

[Full-disclosure] Land Down Under 801 And Prior Multiple SQL Injection Vulnerabilities

//localhost/ldu/list.php?c=%27&s=title&w=asc&o=1&p=1 VENDOR STATUS: == The vendor was contacted using the contacts link on the main page. No response recieved till date. CREDITS: This vulnerability was discovered and researched by - matrix_killer of h4ck

[Full-disclosure] BBCode [IMG] [/IMG ] Tag Vulnerability

Hi, Saw this one on www.waraxe.us (Discovered by Easyex) and i was thinking if there are some more possibilities using the method described. The POC below is for phpBB. - == make yourself a folder on your host rename the folder to signature.jpg this will trick bbcode that its an image f

[Full-disclosure] Re: ATutor 1.5.1 and prior multiple XSS Vulnerabilities

fixed and the fixes will be included in the next release of atutor which is scheduled sometime later. On 8/18/05, h4cky0u <[EMAIL PROTECTED]> wrote: > ATutor 1.5.1 and prior multiple XSS Vulnerabilities > > SEVERITY: > = > Medium > > SOFTWARE: > =

[Full-disclosure] w-agora 4.2.0 and prior Remote Directory Travel Vulnerability

: This vulnerability was discovered and researched by - matrix_killer of h4cky0u Security Forums. mail : matrix_k at abv.bg web : http://www.h4cky0u.org Greets to all omega-team members + krassswr,EcLiPsE and all who support us !!! ORIGINAL: = http://h4cky0u.org/viewtopic.php?t=2097

[Full-disclosure] ATutor 1.5.1 and prior multiple XSS Vulnerabilities

alhost/tour/search.php?search=1&words=";>alert('Found By matrix_killer');&include=all&find_in=all&display_as=pages&submit=Search VENDOR STATUS: == Vendor was contacted but no response received till date. CREDITS: This vulnerability was disco

[Full-disclosure] PHPFreeNews v1.40 and prior Multiple Vulnerabilities

<-');&NewsMode=1&SearchNews=Search&CatID=0 VENDOR STATUS = Vendor contacted on the 17th of August. Vendor Reply (17th of August) - All the bugs have been fixed and will be included in the next release. CREDITS: This vulnerability was discovered and resea

Re: [Full-disclosure] phpWebSite 0.10.1 Full SQL Injection

a more secure release of your script. Thanks. On 8/17/05, Kevin Wilcox <[EMAIL PROTECTED]> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > h4cky0u wrote: > > > > > VENDOR STATUS: > > === > > The vendors were contacted but

[Full-disclosure] phpWebSite 0.10.1 Full SQL Injection

s discovered and researched by matrix_killer of h4cky0u Security Forums. mail : matrix_k at abv.bg web : http://www.h4cky0u.org Greets to all omega-team members + krassswr,EcLiPsE and all who support us !!! === http://h4cky0u.org/viewtopic.php?t=1967