Updated 08_02_2014

files.csv

@@ -30825,3 +30825,7 @@ id,file,description,date,author,platform,type,port
 34221,platforms/asp/webapps/34221.txt,"Iatek PortalApp 3.3/4.0 'login.asp' Multiple Cross Site Scripting Vulnerabilities",2010-06-29,"High-Tech Bridge SA",asp,webapps,0
 34222,platforms/php/webapps/34222.html,"Grafik CMS 'admin.php' SQL Injection and Cross Site Scripting Vulnerabilities",2010-06-29,"High-Tech Bridge SA",php,webapps,0
 34223,platforms/cgi/webapps/34223.txt,"Miyabi CGI Tools 1.02 \'index.pl\' Remote Command Execution Vulnerability",2010-06-29,"Marshall Whittaker",cgi,webapps,0
+34224,platforms/multiple/webapps/34224.txt,"Kryn.cms 6.0 Cross Site Request Forgery and HTML Injection Vulnerabilities",2010-06-29,TurboBorland,multiple,webapps,0
+34225,platforms/php/webapps/34225.txt,"TornadoStore 1.4.3 SQL Injection and HTML Injection Vulnerabilities",2010-06-29,"Lucas Apa",php,webapps,0
+34226,platforms/php/webapps/34226.txt,"System CMS Contentia 'news.php' SQL Injection Vulnerability",2010-06-30,GlaDiaT0R,php,webapps,0
+34229,platforms/php/webapps/34229.txt,"ArcademSX 2.904 'cat' Parameter Cross Site Scripting Vulnerability",2010-06-29,"Th3 RDX",php,webapps,0

platforms/multiple/webapps/34224.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/41229/info
+
+Kryn.cms is prone to a cross-site request-forgery vulnerability and an HTML-injection vulnerability.
+
+Exploiting these issues may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, delete certain data, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible. 
+
+The following example URI is available:
+
+http://www.example.com/admin/backend/window/loadClass/saveItem?noCache=1277145391050&rsn=1&username=admin&passwd=admin&email=suck2%40example.org&groups=[%221%22]&module=users&code=users%2FeditMe%2F 

platforms/php/webapps/34225.txt

@@ -0,0 +1,13 @@
+source: http://www.securityfocus.com/bid/41233/info
+
+TornadoStore is prone to an SQL-injection vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
+
+An attacker may leverage these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.
+
+TornadoStore 1.4.3 is vulnerable; other versions may be vulnerable. 
+
+The following example URIs are available:
+
+http://www.example.com/control/abm_list.php3?db=ts_143&tabla=delivery_courier&tabla_det=delivery_costo&order=&ordor=&tit=&transporte=&ira=&pagina=1&det_order=nDeCSer&det_ordor=asc&txtBuscar=&vars=&where='
+
+http://www.example.com/precios.php3?marca=12' 

platforms/php/webapps/34226.txt

@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/41248/info
+
+System CMS Contentia is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 
+
+http://www.example.com/news.php?id=[SQLi] 

platforms/php/webapps/34229.txt

@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/41252/info
+
+ArcademSX is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
+
+An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
+
+ArcademSX version 2.904 is vulnerable.
+
+http://www.example.com/arcademsx/index.php?cat=[XSS]