Easy Banner Pro 2.8 - info.php Remote File Inclusion

Easy Banner Pro 2.8 - info.php Remote File Inclusion source: https://www.securityfocus.com/bid/21967/info Easy Banner Pro is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the...

PHP Web Scripts Easy Banner Functions.PHP远程文件包含漏洞

PHP Web Scripts Easy Banner是一款基于PHP的web应用程序。 PHP Web Scripts Easy Banner不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'Functions.PHP'脚本对用户提交的'sphppath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 PHP Web Scripts Easy Banner Free 目前没有详细解决方案提供，请关注以下链接：...

CVE-2006-6397

Integer overflow in banner/banner.c in FreeBSD, NetBSD, and OpenBSD might allow local users to modify memory via a long banner. NOTE: CVE and multiple third parties dispute this issue. Since banner is not setuid, an exploit would not cross privilege boundaries in normal operations. This issue is...

CVE-2006-6397

The CVE-2006-6397 entry concerns an alleged integer overflow in the banner/banner.c component across FreeBSD, NetBSD, and OpenBSD. The issue is disputed by CVE and others and, because the banner is not setuid, an exploit would not cross privilege boundaries in normal operations; the notes explici...

PT-2006-7008 · Freebsd +2 · Freebsd +2

Name of the Vulnerable Software and Affected Versions: No vulnerable software versions are specified, as the issue is disputed and not considered a vulnerability. Description: The issue in question pertains to an alleged integer overflow in the banner/banner.c file within FreeBSD, NetBSD, and...

Banex PHP MySQL Banner Exchange多个SQL注入漏洞

Banex PHP MySQL Banner Exchange是一款基于PHP的BANNER交换程序。 Banex PHP MySQL Banner Exchange不正确处理用户提交的WEB数据，远程攻击者可以利用漏洞进行SQL注入获得敏感信息。 问题存在于多个脚本，由于对用户提交的URI参数缺少过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息。 Banex PHP MySQL Banner Exchange 2.21 http://sourceforge.net/projects/banex...

CVE-2006-5166

PHP remote file inclusion vulnerability in functions.php in PHP Web Scripts Easy Banner Free allows remote attackers to execute arbitrary PHP code via a URL in the sphppath parameter...

CVE-2006-5166

CVE-2006-5166 describes a PHP remote file inclusion vulnerability in the PHP Web Scripts Easy Banner Free product. The issue arises in the functions.php file, where the s[phppath] parameter can be exploited to cause the server to include and execute arbitrary PHP code from a remote URL. Affected ...

osCommerce 2.2 - '/admin/banner_statistics.php?page' Cross-Site Scripting

source: https://www.securityfocus.com/bid/20343/info osCommerce is prone to multiple cross-site scripting vulnerabilities. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attack...

PHP Web Scripts Easy Banner - 'functions.php' Remote File Inclusion

source: https://www.securityfocus.com/bid/20295/info Easy Banner is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are als...

PHP Web Scripts Easy Banner - functions.php Remote File Inclusion

PHP Web Scripts Easy Banner - functions.php Remote File Inclusion source: https://www.securityfocus.com/bid/20295/info Easy Banner is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromis...

CVE-2006-3965

Banex PHP MySQL Banner Exchange 2.21 stores lib.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as database usernames and passwords...

CVE-2006-3963

Multiple SQL injection vulnerabilities in Banex PHP MySQL Banner Exchange 2.21 allow remote attackers to execute arbitrary SQL commands via the 1 sitename parameter to a signup.php, and the 2 id, 3 deleteuserbanner, 4 viewmem, 5 viewmemunb, 6 viewunmem,or 7 deleteuser parameters to b admin.php...

CVE-2006-3964

PHP remote file inclusion vulnerability in members.php in Banex PHP MySQL Banner Exchange 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the cfgroot parameter...

CVE-2006-3965

Banex PHP MySQL Banner Exchange 2.21 stores lib.inc under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as database usernames and passwords...

CVE-2006-3965

CVE-2006-3965 affects Banex PHP MySQL Banner Exchange 2.21, where lib.inc is stored under the web document root with insufficient access control. This leads to possible disclosure of sensitive data (e.g., database usernames and passwords) via remote access. The NVD entry reports a base CVSSv2 of ...

CVE-2006-3964

PHP remote file inclusion vulnerability in members.php in Banex PHP MySQL Banner Exchange 2.21 allows remote attackers to execute arbitrary PHP code via a URL in the cfgroot parameter...

CVE-2006-3963

Multiple SQL injection vulnerabilities in Banex PHP MySQL Banner Exchange 2.21 allow remote attackers to execute arbitrary SQL commands via the 1 sitename parameter to a signup.php, and the 2 id, 3 deleteuserbanner, 4 viewmem, 5 viewmemunb, 6 viewunmem,or 7 deleteuser parameters to b admin.php...

CVE-2006-3963

Banex PHP MySQL Banner Exchange 2.21 contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL via user-controlled parameters. Specifically, the site_name parameter to signup.php and the id, deleteuserbanner, viewmem, viewmemunb, viewunmem, and deleteuse...

CVE-2006-3964

The CVE-2006-3964 issue affects Banex PHP MySQL Banner Exchange 2.21, where a PHP remote file inclusion vulnerability in members.php allows an attacker to execute arbitrary PHP code via a URL supplied to the cfg_root parameter. The underlying flaw is improper handling of remote file input, enabli...