VidiScript (Avatar) - Arbitrary File Upload

VidiScript Avatar - Arbitrary File Upload || || | || o,7 || . o7 || 4||| ow, : / / . |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=| | | | /' \ /'\ /\ \ /'\ /\ \ | | /, \ /\/\L\ \ \ \ ,/\ /\ \ \ \ / | | //\ \ /' \ /\ //\ Kings of injection | | // | | |...

Multiple Wsn Products (LFI) Code Execution Vulnerability

No description provided by source. Author: otmorozok428, http://forum.antichat.ru Products: Wsn Forum = 4.1.43, Wsn Knowledge Base = 4.1.36, Wsn Links = 4.1.44, Wsn Gallery = 4.1.30 Vendor: http://www.webmastersite.net Googling: inurl:memberlist.php?action=profile Code Execution Vulnerability:...

Multiple Wsn Products (LFI) Code Execution Vulnerability

Exploit for unknown platform in category web applications ======================================================== Multiple Wsn Products LFI Code Execution Vulnerability ======================================================== Products: Wsn Forum Enter to upload:...

Wsn (Multiple Products) - Local File Inclusion Code Execution

Wsn Multiple Products - Local File Inclusion Code Execution Author: otmorozok428, http://forum.antichat.ru Products: Wsn Forum Enter to upload: http://www.site.com/forum/profile.php?action=editprofile&id=Your User ID See the avatar name at your profile. Upload evil avatar and go to:...

wsnprod-lfiexec.txt

Author: otmorozok428, http://forum.antichat.ru Products: Wsn Forum Enter to upload: http://www.site.com/forum/profile.php?action=editprofile&id=Your User ID See the avatar name at your profile. Upload evil avatar and go to: index.php?custom=yes&TID=../../attachments/avatars/Avatar...

WebmasterSite (Multiple Products) - Remote Command Execution

source: https://www.securityfocus.com/bid/30572/info Multiple WebmasterSite products are prone to a remote shell command-execution vulnerability because the applications fail to sufficiently sanitize user-supplied data. Successfully exploiting this issue will allow an attacker to execute arbitrar...

Wsn (Multiple Products) - Local File Inclusion / Code Execution

Author: otmorozok428, http://forum.antichat.ru Products: Wsn Forum Enter to upload: http://www.site.com/forum/profile.php?action=editprofile&id=Your User ID See the avatar name at your profile. Upload evil avatar and go to: index.php?custom=yes&TID=../../attachments/avatars/Avatar...

CMScout 2.05 (common.php bit) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================ CMScout 2.05 common.php bit Local File Inclusion Vulnerability ================================================================ CMScout 2.05 LFI AUTHOR : IRCRASH R3d.W0rm...

ImperialBB 2.3.5 - Arbitrary File Upload

ImperialBB 2.3.5 - Arbitrary File Upload Title : ImperialBB :\r\n\n"; $code = trimfgetsSTDIN; $socket = @fsockopen$argv1, 80, $eno, $estr, 30...

phptournois-exec.txt

Date: 04-06-08 - Remote Code Execution - Remote File Upload When testing if we are admin, phpTournois checks if $grade'a'=='a'. But when we are not loggued in, this var is not defined. So, using registerglobals, we can define it and let the CMS think we are authentificated. Using configuration zo...

phpTournois G4 - Arbitrary File Upload Code Execution

phpTournois G4 - Arbitrary File Upload Code Execution Date: 04-06-08 - Remote Code Execution - Remote File Upload When testing if we are admin, phpTournois checks if $grade'a'=='a'. But when we are not loggued in, this var is not defined. So, using registerglobals, we can define it and let the CM...

phpTournois <= G4 Remote File Upload/Code Execution Exploit

?php / Name: phpTournois = G4 Remote File Upload/Code Execution Exploit Credits: Charles "real" F. charlesfolathotmail.fr Date: 04-06-08 - Remote Code Execution - Remote File Upload When testing if we are admin, phpTournois checks if $grade'a'=='a'. But when we are not loggued in, this var is not...

Exero CMS 1.0.1 (theme) Multiple Local File Inclusion Vulnerabilities

No description provided by source. Exero CMS 1.0.1 theme Multiple Local File Inclusion Vulnerabilities Script : http://switch.dl.sourceforge.net/sourceforge/exerocms/ExeroCMS1-0-1.rar Home Page : http://ecms.getox.net/ POC : /ExeroCMS1-0-1/themes/Default/usercp/index.php?theme=Local File %00...

Exero CMS 1.0.1 - theme Multiple Local File Inclusions

Exero CMS 1.0.1 - theme Multiple Local File Inclusions Exero CMS 1.0.1 theme Multiple Local File Inclusion Vulnerabilities Script : http://switch.dl.sourceforge.net/sourceforge/exerocms/ExeroCMS1-0-1.rar Home Page : http://ecms.getox.net/ POC :...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to inscription.php, 2 courseCode parameter to main/calendar/myagenda.php, 3 category parameter to main/admin/coursecategory.php, 4 message...

Debian Security Advisory DSA 1063-1 (phpgroupware)

The remote host is missing an update to phpgroupware announced via advisory DSA 1063-1. It was discovered that the Avatar upload feature of FUD Forum, a component of the web based groupware system phpgroupware, does not sufficiently validate uploaded files, which might lead to the execution of...

EkinBoard 1.1.0 - Arbitrary File Upload / Authentication Bypass

---- EkinBoard Remote File Upload / Auth Bypass ... ITDefence.ru Antichat.ru EkinBoard = 1.1.0 Remote File Upload / Auth Bypass Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / //...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via 1 the subject parameter to modules/news/submit.php; 2 the PATHINFO to modules/news/index.php, possibly related to the XoopsPageNav class; or 3 an avatar image...

CVE-2007-6545

Multiple cross-site scripting XSS vulnerabilities in RunCMS before 1.6.1 allow remote attackers to inject arbitrary web script or HTML via 1 the subject parameter to modules/news/submit.php; 2 the PATHINFO to modules/news/index.php, possibly related to the XoopsPageNav class; or 3 an avatar image...

CVE-2002-2346

CVE-2002-2346 affects phpBB 2.0 through 2.0.3. The vulnerability arises in how avatar file names are generated: they use hex-encoded client IP addresses, allowing remote attackers to obtain the client’s IP address by inspecting the uploaded avatar filename. The connected Red Hat and CVE records c...