Improvement on Web Application Authentication Testing parameters to use a higher number of values between the authentication probes.
Improvement on Web Application Authentication Testing parameters to use a high number of values between the authentication probes.
Magento eCommerce Web Sites suffers from a Authentication Bypass Vulnerability, a Blind SQL Injection Vulnerability and a Remote File Inclusion Vulnerability.
These 3 vulnerabilities, allows an attacker to gain arbitrary code execution on the affected system.
These 3 vulnerabilities, allows an attacker to gain arbitrary code execution on the affected system.
A weakness has been reported in WordPress which can be exploited to bypass certain security restrictions. The weakness is due to a bug within the password reset functionality when verifying the secret key. This can be exploited to reset the password of the first user without a key in the database (usually administrator) without providing the correct secret key.
A vulnerability has been reported in MyBB, which can be exploited by malicious users to conduct SQL injection attacks. Input passed via the "birthdayprivacy" parameter to inc/datahandlers/user.php is not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. Successful exploitation requires a valid user account. The vulnerability is reported in MyBB 1.4.x versions prior to 1.4.7.
An attacker, able to register a specially crafted username on a Wordpress 2.5 installation, will also be able to generate authentication cookies for other chosen accounts. This vulnerability exists because it is possible to modify authentication cookies without invalidating the cryptographic integrity protection. The proper way to exploit this vulnerability is
to use a Wordpress account which its username starts with the word
"admin", for example "admin99". This exploit will not be shown on WebApps reports.
to use a Wordpress account which its username starts with the word
"admin", for example "admin99". This exploit will not be shown on WebApps reports.
This module exploits an authentication vulnerability in OpenSite 2.1. The function init in origin/libs/user.php checks for a matching origin_hash cookie. However, this cookie can be bruteforced in at most 2^32 tries for a known username. Actually, the number of attempts could be significantly reduced knowing that we do not have to check for time in the future, and long past. This works for OpenSite 2.1 and below.