145 matches found
Sql injection
Multiple SQL injection vulnerabilities in AuraCMS 1.5rc allow remote attackers to execute arbitrary SQL commands via the id parameter in 1 hal.php, 2 cetak.php, 3 lihat.php, 4 pesan.php, and 5 teman.php, different vectors than CVE-2007-4171. NOTE: the scripts may be accessed through requests to t...
CVE-2007-4171
The CVE-2007-4171 entry describes a SQL injection in auraCMS’s Forum Module (Forum Sederhana) via the id parameter to the default URI, affecting komentar.php. The vulnerability allows remote attackers to execute arbitrary SQL commands, with impacts described as partial confidentiality/integrity/a...
CVE-2005-4171
The "Upload new image" command in the "Manage Images" eFiction 1.1, when members are allowed to upload images, allows remote attackers to execute arbitrary PHP code by uploading a filename with a .php extension that contains a GIF header, which passes the image validity check but executes any PHP...
CVE-2005-4171
The CVE reports a remote PHP code execution in eFiction 1.1 when image-upload is allowed. An uploaded file named with a .php extension can start as a GIF (passes image validation) but contains PHP code that gets executed by the web server, enabling arbitrary code execution. The vulnerability stem...
