Bitrix Site Manager Remote File Inclusion

Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just write this exploit under perl module...

Bitrix Site Manager Multiple Remote File Include Vulnerability

No description provided by source. + Author : Don Tukulesto [email protected] + Date : November 13, 2009 + Homepage : http://www.indonesiancoder.com + Vendor : http://www.bitrixsoft.com/ + Method : Remote File Inclusion + Location : INDONESIA Notes : I know this is an old bugs, but i just...

Bitrix Site Manager 67 - Multiple Input Validation Vulnerabilities

Bitrix Site Manager 67 - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/33689/info Bitrix Site Manager is prone to multiple input-validation vulnerabilities: - An authentication-bypass vulnerability - A cross-site scripting vulnerability An attacker may levera...

Bitrix Site Manager 6/7 - Multiple Input Validation Vulnerabilities

source: https://www.securityfocus.com/bid/33689/info Bitrix Site Manager is prone to multiple input-validation vulnerabilities: - An authentication-bypass vulnerability - A cross-site scripting vulnerability An attacker may leverage these issues to gain unauthorized access to the affected...

Open redirect

Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter...

CVE-2008-2052

Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter...

CVE-2008-2052

Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter...

CVE-2008-2052

The CVE-2008-2052 entry describes an open redirect vulnerability in redirect.php of Bitrix Site Manager 6.5, exploitable via a URL in the goto parameter. The issue could allow remote attackers to redirect users to arbitrary sites, enabling phishing-style redirection. Affected component: Bitrix Si...

PT-2008-3569 · Bitrix +1 · Bitrix Site Manager +1

Name of the Vulnerable Software and Affected Versions: Bitrix Site Manager version 6.5 Description: The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter in the redirect.php file. This can lead to unauthorized acces...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative interface Bitrix Site Manager 4.1.x allows remote attackers to inject arbitrary web script or HTML via unspecified inputs...

CVE-2006-2476

Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information...

CVE-2006-2478

Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified backurl during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term...

CVE-2006-2479

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site...

Improper access control

Bitrix Site Manager 4.1.x stores updater.log under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information...

Cross site scripting

Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified backurl during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term...

Design/Logic Flaw

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site...

CVE-2006-2477

Cross-site scripting XSS vulnerability in the administrative interface Bitrix Site Manager 4.1.x allows remote attackers to inject arbitrary web script or HTML via unspecified inputs...

CVE-2006-2478

Bitrix Site Manager 4.1.x allows remote attackers to redirect users to other websites via a modified backurl during a HTTP POST request. NOTE: this issue has been referred to as "cross-site scripting," but that is inconsistent with the common use of the term...

CVE-2006-2478

Bitrix Site Manager 4.1.x is affected by CVE-2006-2478: remote attackers can redirect users to other websites by supplying a modified back_url in a HTTP POST request. The root cause and impact are limited to redirects as described; exploitation details or in‑the‑wild status are not provided in th...

CVE-2006-2479

The Update functionality in Bitrix Site Manager 4.1.x does not verify the authenticity of downloaded updates, which allows remote attackers to obtain sensitive information and ultimately execute arbitrary PHP code via DNS cache poisoning that redirects the user to a malicious site...