phpRealty 'view.php'远程文件包含漏洞

BUGTRAQ ID: 31213 CNCAN ID：CNCAN-2008091802 phpRealty是一款基于PHP的WEB应用程序。 phpRealty不正确处理用户提交的输入，远程攻击者可以利用漏洞以WEB进程权限执行任意PHP代码。 问题是'view.php'脚本对用户提交的WEB参数缺少过滤，提交远程服务器上的任意文件作为包含文件，可导致以WEB进程权限执行任意PHP代码。 phpRealty phpRealty 0.03 phpRealty phpRealty 0.02 升级到最新phpRealty 0.05版本： http://php-realty.com/...

AvailScript Article Script - 'view.php' SQL Injection

|| | | Article Script view.php v Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | WwW.TrYaG.CC | | email: darkangelg85atYahooDoTcom | | | | | | | | script : http://www.availscript.com/articlescript.php | |...

AvailScript Article Script - view.php SQL Injection

AvailScript Article Script - view.php SQL Injection || | | Article Script view.php v Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : WwW.IQ-ty.CoM | WwW.TrYaG.CC | | email: darkangelg85atYahooDoTcom | | | | | | | | scrip...

Remote file inclusion

PHP remote file inclusion vulnerability in manager/static/view.php in phpRealty 0.03 and earlier, and possibly other versions before 0.05, allows remote attackers to execute arbitrary PHP code via a URL in the INC parameter...

CVE-2008-4134: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in manager/static/view.php in phpRealty 0.03 and earlier, and possibly other versions before 0.05, allows remote attackers to execute arbitrary PHP code via a URL in the INC parameter...

phprealty-rfi.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- phpRealty D.O.M Labs - Security Researchers - www.domlabs.org vuln code: ------------- 11: if!isset$GET'propID' || !isnumeric$GET'propID' || empty$GET'propID' 13: return; 17: include$INC."currconv.class.php"; // -------- Vuln Line!! // t...

phpRealty 0.3 - INC Remote File Inclusion

phpRealty 0.3 - INC Remote File Inclusion -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- phpRealty D.O.M Labs - Security Researchers - www.domlabs.org vuln code: ------------- 11: if!isset$GET'propID' || !isnumeric$GET'propID' || empty$GET'propID' 13: return; 17:...

phpRealty 0.3 - 'INC' Remote File Inclusion

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- phpRealty D.O.M Labs - Security Researchers - www.domlabs.org vuln code: ------------- 11: if!isset$GET'propID' || !isnumeric$GET'propID' || empty$GET'propID' 13: return; 17: include$INC."currconv.class.php"; // -------- Vuln Line!! // t...

phpRealty 0.3 (INC) Remote File Inclusion Vulnerability

No description provided by source. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- phpRealty = 0.03 INC Remote File Inclusion Vulnerability -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- $ Script: phpRealty $ Version: = 0.03 $ File affected: manager/static/view.php $...

sportsclub-sql.txt

...::::: Sports Clubs Web Panel 0.0.1 SQL Injection Vulnerability ::::.... Virangar Security Team www.virangar.net -------- Discoverd By :virangar security teamZahra:zhvirangar special tnx :my master hadihadi tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007 & all virangar members & all hackerz...

Availscript Photo Album (pics.php) Multiple Vulnerabilities

No description provided by source. /\ \ /\ \ \ /\ /\ \ //\ \ \ \ \ \ \ \ \ \ \ /',\ \ \ \ \ \ \ \ /\ /'\ /'\ \ \ \ /\ ,\ /, \ \ \ \ ,\ \ \ \ \ // / // /\//\///\/\ \ \/\ // // // //////// //// security breakd0wn! Title: Availscript Photo Album pics.php Multiple...

AvailScript Photo Album - pics.php Multiple Vulnerabilities

AvailScript Photo Album - pics.php Multiple Vulnerabilities /\ \ /\ \ \ /\ /\ \ //\ \ \ \ \ \ \ \ \ \ \ /',\ \ \ \ \ \ \ \ /\ /'\ /'\ \ \ \ /\ ,\ /, \ \ \ \ ,\ \ \ \ // / // /\//\///\/\ \ \/\ // // // //////// //// security breakd0wn! Title: Availscript Photo...

CVE-2008-3755

SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary SQL commands via the category parameter...

CVE-2008-3755: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary SQL commands via the category parameter...

Butterfly Organizer 2.0.0 (SQL/XSS) Multiple Remote Vulnerabilities

No description provided by source. ====================================================================== Butterfly Organizer 2.0.0 SQL/XSS Multiple Remote Vulnerabilities ====================================================================== ,--^----------,--------,-----,-------^--, | |||||||||...

CVE-2008-2700: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in view.php in Galatolo WebManager 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2008-2565: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in PHP Address Book 3.1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 view.php and 2 edit.php. NOTE: it was later reported that 4.0.x is also affected...

PHP-Address Book <= 3.1.5 (SQL/XSS) Multiple Vulnerabilities

No description provided by source. ============================================================ PHP-Address Book SQL/XSS Multiple Remote Vulnerabilities ============================================================ ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH...

phpaddress-sqlxss.txt

============================================================ PHP-Address Book SQL/XSS Multiple Remote Vulnerabilities ============================================================ ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

PHP-Address Book 3.1.5 - SQL Injection Cross-Site Scripting

PHP-Address Book 3.1.5 - SQL Injection Cross-Site Scripting ============================================================ PHP-Address Book SQL/XSS Multiple Remote Vulnerabilities ============================================================ ,--^----------,--------,-----,-------^--, | |||||||||...