CVE-2006-6167

Multiple PHP remote file inclusion vulnerabilities in L. Brandon Stone and Nathanial P. Hendler Active PHP Bookmarks APB 1.1.02 allow remote attackers to execute arbitrary PHP code via a URL in the APBSETTINGS'apbpath' parameter in 1 apbcommon.php or 2 apb.php. NOTE: CVE and another third party...

CVE-2006-6167

Active PHP Bookmarks (APB) 1.1.02 contains PHP remote file inclusion vulnerabilities allowing remote code execution via a URL in APB_SETTINGS['apb_path'] in apb_common.php or apb.php. Affected components: apb_common.php, apb.php. Root cause: RFI through unvalidated APB_SETTINGS parameter. Impact:...

P-News v2 (user.txt) Remote Password Disclosure Vulnerability

Exploit for unknown platform in category web applications ============================================================= P-News v2 user.txt Remote Password Disclosure Vulnerability ============================================================= P-News V2 - user.txt Information Disclosure Vulnerabili...

P-News v2 (user.txt) Remote Password Disclosure Vulnerability

No description provided by source. P-News V² - user.txt Information Disclosure Vulnerability Critical Level : Dangerous Script Download: http://download.planerd.net/dir/php Bugfounder: Lu7k Contact Me : www.school-of-hack.de or [email protected]...

P-News 2.0 - 'user.txt' Remote Password Disclosure

P-News V² - user.txt Information Disclosure Vulnerability Critical Level : Dangerous Script Download: http://download.planerd.net/dir/php Bugfounder: Lu7k Contact Me : www.school-of-hack.de or [email protected] -----------------------------------------------------------------------------...

P-News 2.0 - user.txt Remote Password Disclosure

P-News 2.0 - user.txt Remote Password Disclosure P-News V² - user.txt Information Disclosure Vulnerability Critical Level : Dangerous Script Download: http://download.planerd.net/dir/php Bugfounder: Lu7k Contact Me : www.school-of-hack.de or [email protected]...

aBitWhizzy - 'abitwhizzy.php' Information Disclosure

aBitWhizzy local file include vendor site: http://www.unverse.net/abitwhizzy/ product : aBitWhizzy bug:local file include global risk : high http://site.com/abitwhizzy.php?f=../../../../../../../etc/passwd laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected] milw0rm.com...

infinsql.txt

product:Infinitytechs Restaurants CM bug:injection sql risk:medium injection sql: /rating.asp?id='sql /mealrest.asp?mealid='sql /resdetails.asp?resid='sql laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected]...

phpmyadmin.txt

vendor site:http://phpmyadmin.net/ product:PhpMyAdmin all version bug: xss permanent & full path disclosure global risk:high xss post : 1 create a table , with whatever name , when it's done , go to "operation" /dboperations.php and add a comment on your table with: '"alertdocument.cookie the...

astoreecom.txt

vendor site:http://www.webinhabit.com/ product:A+ Store E-Commerce bug:injection sql & xss post risk:medium injection sql get : http://site.com/browse.asp?ParentID='sql xss post : in /accountlogin.asp: username = '"alertdocument.cookie'"alertdocument.cookie passwd =...

funkyasp10.txt

vendor site:http://www.funkyasp.co.uk/ product:FunkyASP Glossary v1.0 bug:injection sql risk:medium injection sql : http://www.demo.funkyasp.co.uk/demo/glossary/glossary.asp?alpha='sql laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected]...

carsite.txt

Car Site Manager injection sql & xss get vendor site:http://www.mginternet.com/ product:Car Site Manager bug:injection sql risk:medium injection sql : http://site.com/csm/asp/detail.asp?l=&p='sql http://site.com/csm/asp/listings.asp?l='sql http://site.com/csm/asp/listings.asp?s=search&typ='sql...

A+ Store E-Commerce[ injection sql & xss (post) ]

vendor site:http://www.webinhabit.com/ product:A+ Store E-Commerce bug:injection sql & xss post risk:medium injection sql get : http://site.com/browse.asp?ParentID='sql xss post : in /accountlogin.asp: username =...

speedwiki20.txt

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

Portix-PHP [login bypass & xss (post)]

product:Portix-PHP vendor site :http://portix2.be risk : medium log with : username: 'or''=' passwd : 'or''=' xss post on the forum , vulnerable fields : titre auteur laurent gaffiй & benjamin mossй http://s-a-p.ca/ contact: [email protected]...

Speedwiki 2.0 Arbitrary File Upload Vulnerability

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

CVE-2006-5667

Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pblang parameter to 1 admin.php and 2 pbook.php...

CVE-2006-5667

Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pblang parameter to 1 admin.php and 2 pbook.php...

EUVD-2006-5652

Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pblang parameter to 1 admin.php and 2 pbook.php...

CVE-2006-5667

CVE-2006-5667 affects P-Book up to version 1.17. The vulnerability is described as multiple PHP remote file inclusion flaws allowing an attacker to execute arbitrary PHP code by supplying a URL in the pb_lang parameter to admin.php and pbook.php. The connected records consistently reference this ...