CVE-2009-2182

Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 adpopup.php, 2 camphtml.php, 3 initcontent.php, 4 logout.php, 5 menu.php, and 6 set-author.php in admin-files/; 7...

CVE-2009-2183: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in admin-files/ad.php in Campsite 3.3.0 RC1 allows remote attackers to read and possibly execute arbitrary local files via a .. dot dot in the GLOBALSgcampsiteDir parameter...

CVE-2009-2182: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Campsite 3.3.0 RC1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALSgcampsiteDir parameter to 1 adpopup.php, 2 camphtml.php, 3 initcontent.php, 4 logout.php, 5 menu.php, and 6 set-author.php in admin-files/; 7...

PNphpBB2 <= 1.2i (ModName) Multiple LFI Vulnerabilities

No description provided by source. +=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=+=--=--=--=--=--=-+ | PNphpBB2 = 1.2i ModName Multiple LFI Vulnerabilities | Note | +=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=+=--=--=--=--=--=-+ | discovered by athos -...

EUVD-2008-3495

LoveCMS 1.6.2 does not require administrative authentication for 1 addblock.php, 2 blocks.php, and 3 themes.php in system/admin/, which allows remote attackers to change the configuration or execute arbitrary PHP code via addition of blocks, and other vectors...

Prozilla Topsites 1.0 Arbitrary Edit/Add Users Vulnerability

Exploit for unknown platform in category web applications ============================================================ Prozilla Topsites 1.0 Arbitrary Edit/Add Users Vulnerability ============================================================...

PT-2007-5481 · Unknown · X-Script Guestbook

Name of the Vulnerable Software and Affected Versions: Guestbook Script version 1.9 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the script root parameter to various PHP files, including 'delete.php', 'edit.php', 'inc/common.inc.php', 'database.php',...

MyCMS <= 0.9.8 Remote Command Execution Exploit

Exploit for unknown platform in category web applications =============================================== MyCMS 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0;...

inoutse-exec.txt

!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc this is not a protection for two reasons: i everyone can make a cookie with false credentials ii there isn't any exit or die function after header'Location: index.php' Now look at create...

Inout Search Engine (all version) Remote Code Execution Exploit

Exploit for unknown platform in category web applications =============================================================== Inout Search Engine all version Remote Code Execution Exploit =============================================================== !/usr/bin/php -q -d shortopentag=on this is not a...

Authentication flaw

MyBlog 0.9.8 and earlier allows remote attackers to bypass authentication requirements via the admin cookie parameter to certain admin files, as demonstrated by admin/settings.php...

EUVD-2007-0559

Multiple PHP remote file inclusion vulnerabilities in Xero Portal 1.2 allow remote attackers to execute arbitrary PHP code via a URL in the phpbbrootpath parameter to 1 adminlinkdb.php, 2 adminforumprune.php, 3 adminextensions.php, 4 adminboard.php, 5 adminattachments.php, or 6 adminusers.php in...

CVE-2006-5777: Undefined Security Weakness

Creasito E-Commerce Content Manager 1.3.08 allows remote attackers to bypass authentication and perform privileged functions via a non-empty finame parameter to 1 addnewcont.php, 2 adminpassw.php, 3 amministrazione.php, 4 artins.php, 5 bgcolor.php, 6 cancartcat.php, 7 canccat.php, 8 cancelart.php...

PHP Simple Shop <= 2.0 (abs_path) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ===================================================================== PHP Simple Shop = 2.0 abspath Remote File Inclusion Vulnerability ===================================================================== \ /\ \ / | \ \ | / \ // / | \ |...

PHP Simple Shop 2.0 - abs_path Remote File Inclusion

PHP Simple Shop 2.0 - abspath Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV44$2006 ------------------------------------------------------------------------------ ECHOADV44$2006 PHP Simple Shop = 2.0 abspath Remote File Inclusion...

indexu501.txt

Discovered By CrAshoVeRrIdE indexu remote file include -------------------------- site of script:http://www.nicecoder.com/ ------------------------------------------------- Vulnerable: INDEXU v5.0.1 file include ------------ include$admintemplatepath."msg.php"; admintemplatepath parameter File...

PT-2006-4103 · Upb · Ultimate Php Board

Name of the Vulnerable Software and Affected Versions: Ultimate PHP Board UPB versions 1.9.6 and earlier Description: The issue allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified configuration fields in admin chatconfig.php, admin configcss.php, admi...

Indexu 5.0.1 - 'admin_template_path' Remote File Inclusion

indexu remote file include -------------------------------------------------| Discovered By CrAshoVeRrIdE | Arabian Security Team | -------------------------------------------------| site of script:http://www.nicecoder.com/ ------------------------------------------------- Vulnerable: INDEXU v5.0...

DEBIAN-CVE-2006-0986

WordPress 2.0.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 default-filters.php, 2 template-loader.php, 3 rss-functions.php, 4 locale.php, 5 wp-db.php, and 6 kses.php in the wp-includes/ directory; and 7 edit-form-advanced.php, 8...

phpbb2.0.19 fixes security issues

re: http://www.phpbb.com/phpBB/viewtopic.php?t=352966 Sec fixed XSS issue only valid for Internet Explorer within the url bbcode Sec fixed XSS issue only valid for Internet Explorer if html tags are allowed and enabled Sec added configurable maximum login attempts to prevent dictionary attacks...