CVE-2009-2132

CVE-2009-2132 describes a directory traversal vulnerability in the PHP script global.php of 4images prior to 1.7.7. When magic_quotes_gpc is disabled, an attacker can use directory traversal sequences in the l parameter to include and execute arbitrary local files. Documents do not provide exploi...

CVE-2009-2131

This CVE affects 4images (version 1.7.7 and earlier). The vulnerability is a Cross-site Scripting (XSS) flaw where a remote, authenticated user can inject arbitrary scripts/HTML by supplying a crafted user_homepage value to member.php and then posting a comment on a picture. The underlying issue ...

CVE-2009-2131

Cross-site scripting XSS vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted userhomepage parameter to member.php, and then posting a comment associated with a picture...

4images 1.7.7 Bypass / Cross Site Scripting

|| || | || o,7 || . o7 || q||| o\, : / / . =By: Qabandi =Email: iqaahotmail.fr From Kuwait, PEACE... =Vuln: 4images = 1.7.7 - filter bypass HTML injection/XSS =INFO: =BUY: =DORK: -=/:Conditions:=- --------------------------------------------------------------------------------- ; Magic quotes...

4images <= 1.7.7 Filter Bypass HTML Injection/XSS Vulnerability

No description provided by source. || || | || o,7 || . o7 || q||| o\, : / / . =By: Qabandi =Email: iqaahotmail.fr From Kuwait, PEACE... =Vuln: 4images = 1.7.7 - filter bypass HTML injection/XSS =INFO: =BUY: =DORK: -=/:Conditions:=-...

4Images 1.7.7 - Filter Bypass HTML Injection / Cross-Site Scripting

|| || | || o,7 || . o7 || q||| o\, : / / . =By: Qabandi =Email: iqaahotmail.fr From Kuwait, PEACE... =Vuln: 4images = 1.7.7 - filter bypass HTML injection/XSS =INFO: =BUY: =DORK: -=/:Conditions:=- --------------------------------------------------------------------------------- ; Magic quotes...

4Images 1.7.6 Local Inclusion Vulnerability

Bug file : global.php if isset$HTTPGETVARS'l' || isset$HTTPPOSTVARS'l' $requestedl = isset$HTTPGETVARS'l' ? trim$HTTPGETVARS'l' : trim$HTTPPOSTVARS'l'; if $requestedl != $config'languagedir' && fileexistsROOTPATH.'lang/'.$requestedl.'/main.php' $l = $requestedl; $config'languagedir' = $l;...

4imagesgallery-lfi.txt

. . | / | | \ \ | / / |\ \ \ |/ // / /\ \ / |/ \ / // | / | | / \ /|\ / / / / \ / \ / / / \ | | /\ /\ / \ | \ // est.2007 / / forum.darkc0de.com --d3hydr8 -rsauron-baltazar -sinner01 -C1c4Tr1Z - beenu -Marezzi-P47tr1ck- FeDeReR -MAGE -JeTFyrE- DON-Outlawz and all darkc0de and...

4Images 1.7 - details.php Cross-Site Scripting

4Images 1.7 - details.php Cross-Site Scripting source: https://www.securityfocus.com/bid/20488/info 4images is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code execute in...

CVE-2006-5236

SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the searchuser parameter...

CVE-2006-5236

CVE-2006-5236 is an SQL injection in 4images 1.7.x, exploitable via the search_user parameter in search.php. The vulnerability allows remote authenticated users to execute arbitrary SQL commands through that parameter. A PT-Security advisory for 4Images confirms affected versions (1.7.x) and reco...

CVE-2006-5236

SQL injection vulnerability in search.php in 4images 1.7.x allows remote authenticated users to execute arbitrary SQL commands via the searchuser parameter...

PT-2006-5971 · 4Images · 4Images

Name of the Vulnerable Software and Affected Versions: 4images versions 1.7.x Description: The issue allows remote authenticated users to execute arbitrary SQL commands via the search user parameter in the "search.php" file. Recommendations: For 4images versions 1.7.x, avoid using the search user...

4images-sql.txt

!/usr/bin/php ", $page die"Failed.."; else die"Table Prefix: $tab\n"; if$argv4 $pipe = fsockopen$argv1,80; if!$pipe die"Cannot connect to host."...

SQL injection - 4images

// http://www.w4cking.com Product: 4images 1.7.x http://www.4homepages.de Vulnerability: SQL injection Notes: - SQL injection can be used to obtain password hash - for version 1.7.3, you must log in as a registered user POC:...

4images 1.7.x (search.php) Remote SQL Injection Exploit

No description provided by source. !/usr/bin/php ?php / 4images 1.7.x Remote SQL Injection Vulnerability Usage: php file.php host path table prefix user id Googledork "powered by 4images 1.7.x" Vulnerability: Disfigure Research: h3llfyr3 Coding: Synsta. PoC:...

4images 1.7.x (search.php) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ======================================================= 4images 1.7.x search.php Remote SQL Injection Exploit ======================================================= !/usr/bin/php...

4Images 1.7.x - search.php SQL Injection

4Images 1.7.x - search.php SQL Injection !/usr/bin/php //search.php?searchuser=x%2527%20union%20select%20userpassword%20from%204imagesusers%20where%20username=%2527ADMIN w4ck1ng - w4ck1ng.com / if!$argv3 die"Usage: php $argv0 host path options table prefix user id\n Options: -d: Determine table...

4Images 1.7.x - 'search.php' SQL Injection

!/usr/bin/php //search.php?searchuser=x%2527%20union%20select%20userpassword%20from%204imagesusers%20where%20username=%2527ADMIN w4ck1ng - w4ck1ng.com / if!$argv3 die"Usage: php $argv0 host path options table prefix user id\n Options: -d: Determine table prefix\n Example: php $argv0 domain.com...

Sql injection

Multiple SQL injection vulnerabilities in 4images 1.7.1 and earlier allow remote attackers to execute arbitrary SQL commands via the sessionid parameter in 1 top.php and 2 member.php. NOTE: this issue has also been reported to affect 1.7.2...