Mambo Component nfnaddressbook 0.4 - Remote File Inclusion

Mambo Component nfnaddressbook 0.4 - Remote File Inclusion MAMBO & Joomla NFN Address Book v0.4 nfnaddressbook.php Remote File Include Vulnerabilities script : http://mamboxchange.com/frs/download.php/8191/comnfnaddressbook.zip About : The NFN Address Book manages lists of contacts that can be...

WEBO (Web Organizer) <= 1.0 (baseDir) Remote File Inclusion Vuln

Exploit for unknown platform in category web applications ================================================================ WEBO Web Organizer = 1.0 baseDir Remote File Inclusion Vuln ================================================================ \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ /...

WEBO (Web ORGanizer) 1.0 - 'baseDir' Remote File Inclusion

\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV67$2007 ----------------------------------------------------------------------------------------- ECHOADV67$2007 WEBO Web Organizer = 1.0 baseDir Remote File Inclusion Vulnerability...

Sql injection

Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued ABC 1.00 allow remote attackers to execute arbitrary SQL commands via the id parameter to the 1 updateRow and 2 deleteRow functions in functions.php. NOTE: some of these details are obtained...

CVE-2007-1121

CVE-2007-1121 is a documented SQL injection in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) 1.00. The vulnerability allows remote attackers to manipulate the database by supplying crafted id values to updateRow and deleteRow functions in functions.php. The affected produ...

CVE-2007-1122

CVE-2007-1122 affects Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued (ABC) versions 1.00 and 1.01. The vulnerability is a SQL injection in the id parameter used by the functions.php routines updateRow and deleteRow. The flaw enables remote execution of arbitrary SQL commands as ...

CVE-2007-1121

Multiple SQL injection vulnerabilities in Mathis Dirksen-Thedens ZephyrSoft Toolbox Address Book Continued ABC 1.00 allow remote attackers to execute arbitrary SQL commands via the id parameter to the 1 updateRow and 2 deleteRow functions in functions.php. NOTE: some of these details are obtained...

CVE-2006-4582

Cross-site request forgery CSRF vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other users via unspecified vectors, as demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4578

The Address Book 1.04e is affected by CVE-2006-4578 via export.php, which dumps MySQL contents and writes username and password hash information to a publicly accessible file. Root cause is the dump exposing credentials in publicly accessible storage, enabling remote attackers to obtain sensitive...

CVE-2006-4578

export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL database contents, which allows remote attackers to obtain sensitive information...

CVE-2006-4575

The CVE-2006-4575 entry describes multiple SQL injection vulnerabilities in The Address Book 1.04e. Affected components include user.php (parameters: lastname, firstname, passwordOld, passwordNew, id, language, defaultLetter, newuserPass, newuserType, newuserEmail), search.php (parameters: goTo, ...

CVE-2006-4581

Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows remote attackers to upload arbitrary PHP scripts...

CVE-2006-4577

CVE-2006-4577 affects The Address Book 1.04e. It contains multiple cross-site scripting (XSS) vulnerabilities allowing an attacker to inject arbitrary scripts via: (1) email, (2) websites, (3) groupAddName in save.php; (4) errorMsg in index.php; (5) goTo and (6) search in search.php. CVSS v2 base...

CVE-2006-4581

The CVE-2006-4581 entry concerns The Address Book 1.04e, with an unrestricted file upload vulnerability. The issue arises because the product validates the Content-Type header but does not validate the file extension, enabling remote attackers to upload arbitrary PHP scripts. The impact described...

CVE-2006-4579

Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. dot dot in the language parameter...

CVE-2006-4582

The CVE-2006-4582 entry describes a Cross-site request forgery (CSRF) vulnerability affecting The Address Book 1.04e. The issue allows remote attackers to perform unauthorized actions as other users, demonstrated by deleting arbitrary users via the id parameter in a deleteuser action in users.php...

CVE-2006-4576

The vulnerability CVE-2006-4576 is an XSS in The Address Book 1.04e where remote attackers can inject arbitrary web script by uploading an HTML file with a GIF/JPG extension, which is then rendered by Internet Explorer. The provided connected documents confirm the affected product/version and the...

CVE-2006-4579

CVE-2006-4579 describes a directory traversal vulnerability in The Address Book 1.04e, where the language parameter can be manipulated with ".." to include arbitrary files. The issue arises in users.php and could allow remote attackers to cause file inclusion, with the documented impact: partial ...

CVE-2006-4576

Cross-site scripting XSS vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer...

CVE-2006-4580

The CVE concerns The Address Book 1.04e: register.php allows remote attackers to bypass the 'Allow User Self-Registration' setting by supplying mode=confirm, enabling creation of arbitrary users. This is a client-side/configuration abuse affecting user provisioning, with the root cause described ...