441 matches found
Agora 1.4 RC1 - 'MysqlfinderAdmin.php' Remote File Inclusion
\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV59$2006 ----------------------------------------------------------------------------------------------- ECHOADV59$2006Agora 1.4 RC1 "$SESSIONPATHCOMPOSANT" Remote File Inclusion Vulnerability...
Echo Security Advisory 2006.34
ECHO.OR.ID ECHOADV34$2006 --------------------------------------------------------------------------------------------------- ECHOADV34$2006 W-Agora Web-Agora = 4.2.0 incdir Remote File Inclusion ---------------------------------------------------------------------------------------------------...
[ECHO_ADV_34$2006] W-Agora (Web-Agora) <= 4.2.0 (inc_dir) Remote File Inclusion
ECHO.OR.ID ECHOADV34$2006 --------------------------------------------------------------------------------------------------- ECHOADV34$2006 W-Agora Web-Agora = 4.2.0 incdir Remote File Inclusion ---------------------------------------------------------------------------------------------------...
w-Agora inc_dir Parameter Remote File Inclusion
The remote host is running w-Agora, a web-based forum software written in PHP. The version of w-Agora installed on the remote host fails to sanitize input to the 'incdir' parameter before using it in several scripts to include PHP code. Provided PHP's 'registerglobals' setting is disabled, an...
w-Agora <= 4.2.0 (inc_dir) Remote File Include Exploit
Exploit for unknown platform in category web applications ====================================================== w-Agora perl wagora.pl http://target.com/w-agora/ http://target.com/cmd.txt cmd cmd shell example: cmd shell variable: $GETcmd;...
w-Agora 4.2.0 - inc_dir Remote File Inclusion
w-Agora 4.2.0 - incdir Remote File Inclusion !/usr/bin/perl W-Agora perl wagora.pl http://target.com/w-agora/ http://target.com/cmd.txt cmd cmd shell example: cmd shell variable: $GETcmd;...
w-Agora <= 4.2.0 (inc_dir) Remote File Include Exploit
No description provided by source. !/usr/bin/perl W-Agora = 4.2.0 incdir Remote File Inclusion Exploit Bug Found & code By dedi.dwianto aka theday base on advisory at http://advisories.echo.or.id/adv/adv34-theday-2006.txt www.echo.or.id c 2006 usage: perl wagora.pl target cmd shell location cmd...
CVE-2006-2228
CVE-2006-2228 affects w-Agora (Web-Agora) 4.2.0 with a cross-site scripting (XSS) flaw: a BBCode tag containing a JavaScript event name followed by whitespace before the = character bypasses the regex intended to remove onmouseover/events, enabling remote script execution. The provided documents ...
CVE-2006-2228
Cross-site scripting XSS vulnerability in w-Agora aka Web-Agora 4.2.0 allows remote attackers to inject arbitrary web script or HTML via a post with a BBCode tag that contains a JavaScript event name followed by whitespace before the '=' equals character, which bypasses a restrictive regular...
W-Agora 4.20 XSS
PLEASE NOTE: I am not sure if HTML is an option. I looked through the Administration panel and did not see an option for it, and the fact that there is no BBcode leads me to believe that this is the method of BBCode/etc. W-Agora is a fairly 'nice' bulletin board written in PHP. It allows multiple...
W-Agora 4.2 - BBCode Script Injection
W-Agora 4.2 - BBCode Script Injection source: https://www.securityfocus.com/bid/17751/info W-Agora is prone to a script-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated content. W-Agora...
W-Agora 4.2 - BBCode Script Injection
source: https://www.securityfocus.com/bid/17751/info W-Agora is prone to a script-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated content. W-Agora can be configured to send all user...
W-Agora 'site' Parameter Directory Traversal Vulnerability
W-Agora is prone to directory traversal attacks. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:w-agora:w-agora"; ifdescriptio...
CVE-2002-2128
editform.php in w-Agora 4.1.5 allows local users to execute arbitrary PHP code via .. dot dot sequences in the file parameter...
CVE-2002-2129
CVE-2002-2129 : Cross-site scripting (XSS) in editform.php of w-Agora 4.1.5. The vulnerability occurs when an arbitrary form field name containing script is echoed back during form display, allowing remote script execution in the user’s browser. The provided documents describe the affected softwa...
CVE-2002-2129
Cross-site scripting vulnerability XSS in editform.php for w-Agora 4.1.5 allows remote attackers to execute arbitrary web script via an arbitrary form field name containing the script, which is echoed back to the user when displaying the form...
CVE-2002-2128
CVE-2002-2128 affects editform.php in w-Agora 4.1.5, enabling local users to run arbitrary PHP code via .. sequences in the file parameter (path traversal). Documented by NVD and Red Hat/CVE listings; CVSSv2 base score 4.6 (LOCAL access, LOW attack complexity, PARTIAL confidentiality/integrity/av...
W-Agora 'file' Parameter Directory Traversal Vulnerability
W-Agora is prone to directory traversal attacks. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:w-agora:w-agora"; ifdescriptio...
Agora CGI Cross Site Scripting
The remote web server contains a CGI which is vulnerable to a cross-site scripting issue. Description : Agora is a CGI based e-commerce package. Due to poor input validation, Agora allows an attacker to execute cross-site scripting attacks. SPDX-FileCopyrightText: 2002 Matt Moore Some text...
w-Agora <= 4.2.0 Multiple Vulnerabilities
The version of w-Agora installed on the remote host fails to validate files uploaded with the 'browseavatar.php' and 'insert.php' scripts, which allows an attacker to upload scripts with arbitrary PHP code and then to execute it subject to the privileges of the web server user id. In addition, it...