CVE-2009-1512: Improper Control of Generation of Code

Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php via the adminEMail parameter to SaveConfig.php...

NotFTP config.php本地文件包含漏洞

BUGTRAQ ID: 34636 CVECAN ID: CVE-2009-1407 NotFTP是用PHP编写的基于Web的HTTP-FTP网关。 NotFTP的config.php脚本没有正确地过滤用户所提交的参数，如果远程攻击者在提交的URL请求中使用newlang参数指定了本地系统的恶意文件的话，就可能在Web服务器上读取敏感信息或执行任意代码。以下是config.php脚本中的有漏洞代码段： if isset$newlang requireonce"lib/lang/".$languages$newlang"file"; elseif...

Directory traversal

Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. dot dot in a certain languagesfile parameter...

CVE-2009-1407

Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. dot dot in a certain languagesfile parameter...

CVE-2009-1407

NotFTP 1.3.1 is affected by a directory traversal/Local File Inclusion in config.php. The script fails to properly filter user input in languages[][file] (and related language loading logic), allowing remote attackers to read arbitrary local files via crafted URLs (e.g., .. paths). The vulnerabil...

NotFTP 'config.php' Local File Include Vulnerability

NotFTP is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2009-1407: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in config.php in NotFTP 1.3.1 allows remote attackers to read arbitrary files via a .. dot dot in a certain languagesfile parameter...

NotFTP 1.3.1 (newlang) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ========================================================= NotFTP 1.3.1 newlang Local File Inclusion Vulnerability ========================================================= NotFTP 1.3.1 = Local file include...

NotFTP 1.3.1 Local File Inclusion

NotFTP 1.3.1 = Local file include http://sourceforge.net/projects/notftp/ Author: Kacper Email: [email protected] Home: http://devilteam.pl/ DC++ Hub address: bluber-hub.no-ip.biz:2008 Vuln: File config.php: This is where we decide what language to use. Don't mess with this either. if...

NotFTP 1.3.1 (newlang) Local File Inclusion Vulnerability

No description provided by source. NotFTP 1.3.1 = Local file include http://sourceforge.net/projects/notftp/ Author: Kacper Email: [email protected] Home: http://devilteam.pl/ DC++ Hub address: bluber-hub.no-ip.biz:2008 Vuln: File config.php: This is where we decide what language to use. Don't...

NotFTP 1.3.1 - 'newlang' Local File Inclusion

NotFTP 1.3.1 = Local file include http://sourceforge.net/projects/notftp/ Author: Kacper Email: [email protected] Home: http://devilteam.pl/ DC++ Hub address: bluber-hub.no-ip.biz:2008 Vuln: File config.php: This is where we decide what language to use. Don't mess with this either. if...

NotFTP 1.3.1 - newlang Local File Inclusion

NotFTP 1.3.1 - newlang Local File Inclusion NotFTP 1.3.1 = Local file include http://sourceforge.net/projects/notftp/ Author: Kacper Email: [email protected] Home: http://devilteam.pl/ DC++ Hub address: bluber-hub.no-ip.biz:2008 Vuln: File config.php: This is where we decide what language to us...

CVE-2009-1278

Gravity Board X (GBX) 2.0 BETA has a static code injection in forms/ajax/configure.php that allows remote attackers to inject arbitrary PHP code into config.php via the configure action to index.php. Affected: GBX 2.0 BETA; vulnerable file: forms/ajax/configure.php. Root cause: configuration work...

CVE-2009-1230

Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change action...

CVE-2009-1230: Improper Control of Generation of Code

Static code injection vulnerability in index.php in Podcast Generator 1.1 and earlier allows remote authenticated administrators to inject arbitrary PHP code into config.php via the recent parameter in a config change action...

Firepack (admin/ref.php) Remote Code Execution Exploit

Exploit for unknown platform in category web applications ====================================================== Firepack admin/ref.php Remote Code Execution Exploit ====================================================== !/usr/bin/perl Firepack - Remote Command\Code Execution Exploit Firepack is ...

FreeLyrics 1.0 File Disclosure

Piker FreeLyrics Remote Source Code Disclosure Vulnerability Affected software: FreeLyrics Vendor: http://lyrics.sourceforge.net/ Risk: Medium http://target/path/source.php?p=FILE PoC: http://target/path/source.php?p=config.php Found by Piker piker0x90atgmaildotcom D.O.M Labs - Security Researche...

WordPress Plugin Page Flip Image Gallery 0.2.2 - Remote File Disclosure

WordPress Plugin Page Flip Image Gallery 0.2.2 - Remote File Disclosure | | | \ \ \ / / / \ / | / | / | | | | | | \ V / / \ | | | | | | | | | | | / \ | || | | | | | || || \ || // \ | | | Wordpress Plugin Page Flip Image Gallery = 0.2.2 Remote File Disclosure Vulnerability D :...

WordPress Plugin Page Flip Image Gallery 0.2.2 - Remote File Disclosure

| | | \ \ \ / / / \ / | / | / | | | | | | \ V / / \ | | | | | | | | | | | / \ | || | | | | | || || \ || // \ | | | Wordpress Plugin Page Flip Image Gallery = 0.2.2 Remote File Disclosure Vulnerability D : http://downloads.wordpress.org/plugin/page-flip-image-gallery.0.2.2.zip Poc :...

H2O-CMS <= 3.4 Remote Command Execution Exploit (mq = off)

No description provided by source. !/usr/bin/perl ---------------------------------------------------------- H2O-CMS = 3.4 Remote Command Execution Exploit mq = Off Discovered By StAkeRathotmaildotit Download On http://sourceforge.net/projects/h2o-cms...