EUVD-2008-6942

Malware in sbrugna...

Code injection

modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers to execute arbitrary PHP code via the HTTP Referer header with a target file specified in the gvfolderdata parameter, as demonstrated by modifying modules/tool/url2header.php...

CVE-2008-6982

Cross-site scripting XSS vulnerability in index.php in devalcms 1.4a allows remote attackers to inject arbitrary web script or HTML via the currentpath parameter...

CVE-2008-6983

CVE-2008-6983 affects devalcms 1.4a: the file modules/tool/hitcounter.php allows remote code execution via the HTTP Referer header using the gv_folder_data parameter, demonstrated by modifying modules/tool/url2header.php. This indicates improper handling of user-controlled input in the vulnerable...

devalcms 1.4a XSS / Remote Code Execution Exploit

Exploit for unknown platform in category web applications ================================================= devalcms 1.4a XSS / Remote Code Execution Exploit ================================================= !/usr/bin/python devalcms v1.4a Remote Code Execution Exploit / Xss Discovered by : IRCRA...

Devalcms 1.4a - Cross-Site Scripting Remote Code Execution

Devalcms 1.4a - Cross-Site Scripting Remote Code Execution !/usr/bin/python devalcms v1.4a Remote Code Execution Exploit / Xss AUTHOR : IRCRASH R3d.W0rm Sina Yazdanmehr Discovered by : IRCRASH R3d.W0rm Sina Yazdanmehr Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Sina...

Dana IRC 1.4a - Remote Buffer Overflow

Dana IRC 1.4a - Remote Buffer Overflow !/usr/bin/perl ksOSe - 08/24/2008 This is a useless and not portable exploit code, tested only on my winxp-sp3 VM. I was looking for a vuln to write an exploit for when I found this PoC: http://www.milw0rm.com/exploits/5817 The author wrote: "The reason why...

Directory traversal

Directory traversal vulnerability in func.php in Devalcms 1.4a, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the currentpath parameter, in conjunction with certain ... triple dot and ..... sequences in the currentfile...

Devalcms 1.4a - currentfile Local File Inclusion

Devalcms 1.4a - currentfile Local File Inclusion ===================================================== Devalcms 1.4a Local File Inclusion Vulnerability ===================================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground...