farhad koosha

11 exploits Active since May 2005
CVE-2005-3320 EXPLOITDB html WORKING POC
SiteTurn Domain Manager Pro - Cross-Site Scripting via Panel Script Err Parameter
Cross-site scripting (XSS) vulnerability in SiteTurn Domain Manager Pro allows remote attackers to inject arbitrary web script or HTML via the err parameter in the panel script.
CVE-2006-3772 EXPLOITDB text WORKING POC
PHP-Post 0.21 and 1.0 - Unauthenticated Privilege Escalation via Login Cookie Manipulation
PHP-Post 0.21 and 1.0, and possibly earlier versions, when auto-login is enabled, allows remote attackers to bypass security restrictions and obtain administrative privileges by modifying the logincookie[user] setting in the login cookie.
EIP-2026-100580 EXPLOITDB html WORKING POC
Techno Dreams (Multiple Scripts) - Multiple SQL Injections
EIP-2026-100101 EXPLOITDB text WORKING POC
Aenovo - Multiple Cross-Site Scripting Vulnerabilities
CVE-2005-0854 EXPLOITDB text WRITEUP
betaparticle bp blog <4 - Auth Bypass
betaparticle blog (bp blog), posisbly before version 4, allows remote attackers to bypass authentication and (1) upload files via a direct request to upload.asp or (2) delete files via a direct request to myFiles.asp.
CVE-2005-0802 EXPLOITDB text WORKING POC
ACS Blog 0.8-1.1b - Cross-Site Scripting via Search Parameter
Cross-site scripting (XSS) vulnerability in search.asp in ACS Blog 0.8 through 1.1b allows remote attackers to execute arbitrary web script or HTML via the search parameter.
CVE-2005-0853 EXPLOITDB text WRITEUP
betaparticle blog <3.0 - Info Disclosure
betaparticle blog (bp blog) stores the database under the web root, which allows remote attackers to obtain sensitive information via a direct request to (1) dbBlogMX.mdb for versions before 3.0, or (2) Blog.mdb for versions 3.0 and later. NOTE: it was later reported that vector 2 also affects versions 6.0 through 9.0.
CVE-2006-1123 EXPLOITDB perl WORKING POC
d2kblog 1.0.3 - SQL Injection via memName Cookie Parameter
SQL injection vulnerability in D2KBlog 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the memName parameter in a cookie.
CVE-2005-0854 EXPLOITDB text WRITEUP
betaparticle bp blog <4 - Auth Bypass
betaparticle blog (bp blog), posisbly before version 4, allows remote attackers to bypass authentication and (1) upload files via a direct request to upload.asp or (2) delete files via a direct request to myFiles.asp.
CVE-2005-3208 EXPLOITDB text WRITEUP
aenovo - SQL Injection via Password Parameter in control.asp
Multiple SQL injection vulnerabilities in (1) aeNovo, (2) aeNovoShop and (3) aeNovoWYSI allow remote attackers to execute arbitrary SQL code via (a) the password parameter in control.asp, and (b) the strSQL parameter in search.asp, which can enable XSS attacks in resulting error messages.
CVE-2005-3208 EXPLOITDB html WORKING POC
aenovo - SQL Injection via Password Parameter in control.asp
Multiple SQL injection vulnerabilities in (1) aeNovo, (2) aeNovoShop and (3) aeNovoWYSI allow remote attackers to execute arbitrary SQL code via (a) the password parameter in control.asp, and (b) the strSQL parameter in search.asp, which can enable XSS attacks in resulting error messages.