Authentication flaw

admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the isadmin parameter to 1...

Directory traversal

Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2007-2007

admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the isadmin parameter to 1...

Sql injection

Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 pseudo or 2 passe parameter...

CVE-2007-2007

CVE-2007-2007 affects admin.php in pL-PHP beta 0.9. The vulnerability allows remote attackers to bypass authentication by setting the is_admin parameter to 1, enabling unauthorized access. The NVD entry assigns a CVSS v2 base score of 7.5 (HIGH) with Network attack vector, Low attack complexity, ...

CVE-2007-2008

CVE-2007-2008 is a directory traversal vulnerability in pL-PHP beta 0.9 (admin.php) allowing remote attackers to include and execute arbitrary local files via a .. in the lang parameter. The NVD entry confirms the vulnerability and impact (partial confidentiality, integrity, and availability affe...

CVE-2007-2007

admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the isadmin parameter to 1...

CVE-2007-2008

Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2007-2000

CVE-2007-2000 affects Crea-Book 1.0 and earlier. The vulnerability is multiple SQL injection flaws in admin/admin.php, exploitable via the (1) pseudo or (2) passe parameter, allowing remote attackers to run arbitrary SQL commands. The description in the connected documents confirms this vector an...

CVE-2007-2000: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 pseudo or 2 passe parameter...

CVE-2007-2007: Undefined Security Weakness

admin.php in pL-PHP beta 0.9 allows remote attackers to bypass authentication by setting the isadmin parameter to 1...

CVE-2007-2008: Undefined Security Weakness

Directory traversal vulnerability in admin.php in pL-PHP beta 0.9 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2007-1975: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in SLAED CMS 2 allow remote attackers to execute arbitrary PHP code via a URL in the 1 path parameter to admin/admin.php or the 2 modpath parameter to index.php...

slaed-rfi.txt

By Hasadya Raed Contact : [email protected] Israel ----------------------------------------------- Script : SLAEDCMS2 Dork : "Web site engine code is Copyright © 2006 by SLAED CMS. All rights reserved" ----------------------------------------------- B.Files : admin.php index.php...

Remot File Include In SLAED_CMS_2

By Hasadya Raed Contact : [email protected] Israel ----------------------------------------------- Script : SLAEDCMS2 Dork : "Web site engine code is Copyright © 2006 by SLAED CMS. All rights reserved" ----------------------------------------------- B.Files : admin.php index.php...

CVE-2007-1732: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2006-7173

Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted optionnewreportwday parameter in a preferenze action, which can be later accessed via option/php-stats-options.php...

CVE-2006-7173: Undefined Security Weakness

Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted optionnewreportwday parameter in a preferenze action, which can be later accessed via option/php-stats-options.php...

CVE-2007-1486: Undefined Security Weakness

PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the includepath parameter to admin.php, probably due to a dynamic variable evaluation vulnerability...

Lazarus Guestbook (admin.php)Remote File Include Expliot

Lazarus Guestbook admin.phpRemote File Include Expliot D.Script: http://www.carbonize.co.uk Dork: "Powered by Lazarus Guestbook from carbonize.co.uk" Discovered by Crackman Homepage: http://www.b0rizq.biz Greetz To :B0rizq & redcasper & Draknaz kaiba & brokenproxy and all freind Exploit:...