11in1 CMS 1.2.1 - Local File Inclusion (LFI)

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php. id: CVE-2012-0996 info: name: 11in1 CMS 1.2.1 - Local File Inclusion LFI author: daffainfo...

CVE-2012-0996

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php...

11in1 CMS 1.0.1 (do.php) - CRLF Injection Vulnerability

No description provided by source. 11in1 CMS v1.0.1 do.php CRLF Injection Vulnerability Vendor: 11in1 Product web page: http://www.11in1.org Affected version: 1.0.1 Summary: Eleven in One is an open-source content management system CMS that is powered by PHP and MySQL. It does not only help you...

11in1 CMS 1.2.1 - admincomments?topicID SQL Injection

11in1 CMS 1.2.1 - admincomments?topicID SQL Injection source: https://www.securityfocus.com/bid/52306/info 11in1 CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issue...

11in1 CMS 1.2.1 - admintps?id SQL Injection

11in1 CMS 1.2.1 - admintps?id SQL Injection source: https://www.securityfocus.com/bid/52306/info 11in1 CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could...

11in1 CMS 1.2.1 SQL Injection

Title: ====== 11in1 CMS v1.2.1 - SQL Injection Vulnerabilities Date: ===== 2012-03-05 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=465 VL-ID: ===== 465 Introduction: ============= 11in1 is an open-source content management system CMS that is powered by PHP and MySQL...

11in1 CMS v1.2.1 - SQL Injection Vulnerabilities

Document Title: =============== 11in1 CMS v1.2.1 - SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=465 Release Date: ============= 2012-03-05 Vulnerability Laboratory ID VL-ID: ==================================== 465 Produc...

11in1 CMS 1.2.1 - 'admin/tps?id' SQL Injection

source: https://www.securityfocus.com/bid/52306/info 11in1 CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the applicatio...

11in1 CMS 1.2.1 - 'admin/comments?topicID' SQL Injection

source: https://www.securityfocus.com/bid/52306/info 11in1 CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the applicatio...

11in1 CMS v1.2.1 - SQL Injection Vulnerabilities

Document Title: =============== 11in1 CMS v1.2.1 - SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=465 Release Date: ============= 2012-03-05 Vulnerability Laboratory ID VL-ID: ==================================== 465 Produc...

Multiple vulnerabilities in 11in1

Advisory ID: HTB23071 Product: 11in1 Vendor: 11in1 Vulnerable Versions: 1.2.1 stable 12-31-2011 and probably prior Tested Version: 1.2.1 stable 12-31-2011 Vendor Notification: 25 January 2012 Public Disclosure: 15 February 2012 Vulnerability Type: Local File Inclusion, Сross-Site Request Forgery...

CVE-2012-0997

CVE-2012-0997: CSRF vulnerability in 11in1 1.2.1 stable (12-31-2011) affecting admin/index.php, allowing an attacker to hijack administrator authentication to perform addTopic requests. Multiple connected sources corroborate CSRF context and impact (topic creation via addTopic) with PoC examples ...

CVE-2012-0996

CVE-2012-0996 affects the 11in1 CMS, version 1.2.1 stable. Affected component: the PHP parameter class in index.php and admin/index.php, where directory traversal is not properly validated, enabling Local File Inclusion to read arbitrary files. Impact: read access to sensitive files (internal pat...

CVE-2012-0997: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action...

PT-2012-3001

Name of the Vulnerable Software and Affected Versions 11in1 version 1.2.1 Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This can be achieved by including a .. dot dot in the class parameter to API endpoints such as...

PT-2012-3002

Name of the Vulnerable Software and Affected Versions 11in1 version 1.2.1 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that add new topics via an "addTopic" action. Recommendations For version 1.2.1, as a...

CVE-2012-0996: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php...

11in1 1.2.1 Stable 12-31-2011 Cross Site Request Forgery / Local File Inclusion

Advisory ID: HTB23071 Product: 11in1 Vendor: 11in1 Vulnerable Versions: 1.2.1 stable 12-31-2011 and probably prior Tested Version: 1.2.1 stable 12-31-2011 Vendor Notification: 25 January 2012 Public Disclosure: 15 February 2012 Vulnerability Type: Local File Inclusion, Сross-Site Request Forgery...

11in1 Cross Site Request Forgery and Local File Include Vulnerabilities

11in1 is prone to a cross-site request-forgery and a local file include vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

11in1 CMS 1.2.1 - index.php?class Traversal Local File Inclusion

11in1 CMS 1.2.1 - index.php?class Traversal Local File Inclusion source: https://www.securityfocus.com/bid/52025/info 11in1 is prone to a cross-site request-forgery and a local file include vulnerability. An attacker may leverage these issues to execute arbitrary script code in the browser of an...