CVE-2005-1512

The Admin panel in PwsPHP 1.2.2 does not properly verify uploaded picture files, which allows remote attackers to upload and possibly execute arbitrary files...

e107 search.php search_info Parameter Traversal Arbitrary File Inclusion

The version of e107 installed on the remote host is affected by a remote file inclusion vulnerability because it fails to properly sanitize user-supplied input to the 'searchinfo' parameter of the 'search.php' script. This vulnerability could allow a remote, unauthenticated attacker to view...

Sql Injection in CJ Ultra Plus v1.0.3-1.0.4

ADVISORY Sql Injection in CJ Ultra Plus v1.0.3-1.0.4? "My God, it's full of stars" - c MwNN Vulnerable code is in out.php ---code begin-- ... if isset$perm $query = "select a1, a2 from trade where a1 = '$perm'"; -muhahaha $result = mysqlquery$query; if!$result errormessagesqlerror; ... ---code...

CVE-2004-0358

Cross-site scripting XSS vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via 1 the mainnews parameter in admin.php, 2 the expand parameter in admin.php, 3 the id parameter in admin.php, 4 the catid parameter in admin.php, or 5 a...

PHP-Nuke 7.4 Multiple XSS Vulnerabilities Patch

CODEBUG LABS PATCH 1 to XSS Vulnerabilities in Admin Panel of PHP-NUKE 7.4 To Patch your admin panel from this vulnerabilities hurricane you have to apply this code to your admin.php file: if !empty$HTTPGETVARS'admin' die"Shit! Mantra wins ="; if !empty$HTTPPOSTVARS'admin' die"Shit! Mantra wins =...

CVE-2004-0358

CVE-2004-0358 is a cross-site scripting (XSS) vulnerability in VirtuaNews Admin Panel Pro 1.0.3 . The issue allows remote attackers to execute arbitrary script as another user by supplying crafted input through multiple parameters in admin.php (specifically the mainnews , expand , id , and catid ...

CVE-2004-0358

Cross-site scripting XSS vulnerability in VirtuaNews Admin Panel Pro 1.0.3 allows remote attackers to execute arbitrary script as other users via 1 the mainnews parameter in admin.php, 2 the expand parameter in admin.php, 3 the id parameter in admin.php, 4 the catid parameter in admin.php, or 5 a...

VirtuaNews Admin Panel 1.0.3 Pro Cross Site Scripting Vulnerabillity

Software: VirtuaNews Admin Panel Vendor: http://www.virtuanews.co.uk Versions: 1.0.3 Pro Platforms: Unix/Windows Bug: Cross Site Scripting Vulnerabillity Risk: Medium Exploitation: Remote with browser Date: 19 Feb 2004 Author: Rafel Ivgi, The-Insider e-mail: [email protected] web:...

virtuanews103.txt

Software: VirtuaNews Admin Panel Vendor: http://www.virtuanews.co.uk Versions: 1.0.3 Pro Platforms: Unix/Windows Bug: Cross Site Scripting Vulnerabillity Risk: Medium Exploitation: Remote with browser Date: 19 Feb 2004 Author: Rafel Ivgi, The-Insider e-mail: [email protected] web:...

JBrowser _admin/ Direct Request Admin Authentication Bypass

The remote host is running JBrowser - a PHP script designed to browse photos and files in a remote directory. It is possible to access the admin panel by directly requesting '/admin/'. A remote attacker could exploit this to perform administrative actions without authentication. %NASLMINLEVEL 703...

Получение доступа к панели администрирования в Willwin's Web Voting v.1.0

Получение доступа к панели администрирования в Willwin's Web Voting v.1.0 Название скрипта: Willwin's Web Voting Уязвимая версия: v.1.0 Сайт производителя: http://willwin.plex.ru Автор: [email protected] Дата: 13th December 2003 Пароль для получения доступа к панели управления голосованием в...

UPB: Discussion Board/Web-Site Takeover

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: UPB: Discussion Board/Web-Site Takeover product: Ultimate PHP Board v1.9 latest vendor: www.myupb.com risk: high date: 05/24/2k3 discovered by: euronymous /F0KP advisory urls: http://f0kp.iplus.ru/bz/024.en.txt...

InterForum v.1.0.0 BETA 1 many holes

InterForum v.1.0.0 BETA 1 many holes Founder : MaskNBTA -- [email protected] Date : 6/18/2003 Version : 1.0 Beta 1 maybe all below version Problems : + XSS bug + Read private message ' s another account + Change profile ' s another account ---- access admin panel 1/ XSS bug : In...

UPB: Discussion Board/Web-Site Takeover

=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::=:=:=::= topic: UPB: Discussion Board/Web-Site Takeover product: Ultimate PHP Board v1.9 latest vendor: www.myupb.com risk: high date: 05/24/2k3 discovered by: euronymous /F0KP advisory urls: http://f0kp.iplus.ru/bz/024.en.txt...

MyGuestBK - Unauthorized Admin Panel Access

MyGuestBK - Unauthorized Admin Panel Access source: https://www.securityfocus.com/bid/7213/info MyGuestBk has been reported vulnerable to unauthorized Admin Panel Access. It has been reported that an attacker may access arbitrary MyGuestBK administrative functions through the MyGuestBK...

MyGuestBK - Unauthorized Admin Panel Access

source: https://www.securityfocus.com/bid/7213/info MyGuestBk has been reported vulnerable to unauthorized Admin Panel Access. It has been reported that an attacker may access arbitrary MyGuestBK administrative functions through the MyGuestBK administration panel without prior authorization...

Easily and Remotely Pipe a Covert Shell on phpBB version 1.4.0 and below

note to editors: please leave all links intact. Easily and Remotely Pipe a Covert Shell on phpBB version 1.4.0 and below found and written by: [email protected] http://www.modernhacker.com phpBB, is an open source bulletin board created by the phpBB group phpbb.com . Versions 1.4.0 and belo...

allmanage.pl-admin.txt

Allmanage.pl Admin Password vulnerability 15 may 2000 Another allmanage.pl vulnerability see also allmanage.pl.txt Everybody can easily get the admin password from the allmanage directory. You are able to set/change lots of variables, add accounts, mail users, backup, restore, edit header/footer...