Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 16/10/2008 Updated: 29/09/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote malicious users to execute arbitrary SQL commands via (1) the username parameter to admin/login.php and (2) the post parameter to admin/news.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
stash stash 1.0.3

#!/usr/bin/perl -w # # User credentials disclosure exploit - stash103exppl # # Gnix <gnixmail@gmailcom> # gnixnetsonsorg # # This exploit use an SQL Injection in the file admin/loginphp to # bypass the login, and then an SQL Injection in the admin/newsphp # to extract all the users info Note: password are crypted with md5 # ...

CWE-89 http://www.securityfocus.com/bid/31687 http://securityreason.com/securityalert/4413 https://exchange.xforce.ibmcloud.com/vulnerabilities/45799 https://www.exploit-db.com/exploits/6714 https://nvd.nist.gov https://www.exploit-db.com/exploits/6714/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2008-4590

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect