[Full-disclosure] Noah's Classifieds Multiple Cross-Site Scripting Vulnerabilities

Advisory 10 Title: Noah's Classifieds Multiple Cross-Site Scripting Vulnerabilities Author: 0ozeuso0 Arturo Z. Contact: [email protected] Website: www.elitemexico.org Date: 09/03/2006 Risk: Medium Vendor Url: http://classifieds.phpoutsourcing.com/ Affected Software: Noah's Classifieds Non...

Updated Noah Classifieds Component for Joomla!/Mambo

Updated Noah Classifieds Component for Joomla!/Mambo fixes vulnerabilities Problem: Several vulnerabilities were recently discovered in Noah Classifieds 1.3 which also affect the Joomla!/Mambo component. Details on the vulnerabilities are available at http://www.kapda.ir/advisory-268.html The...

Sql injection

SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors...

Remote file inclusion

Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when registerglobals is enabled, allow remote attackers to include arbitrary PHP files via the 1 upperTemplate and 2 lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to...

CVE-2006-0879

SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors...

Path traversal

Noah's Classifieds 1.3 allows remote attackers to obtain the installation path via a direct request to include files, as demonstrated by classifieds/gorum/category.php...

CVE-2006-0881

Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when registerglobals is enabled, allow remote attackers to include arbitrary PHP files via the 1 upperTemplate and 2 lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to...

CVE-2006-0882

Directory traversal vulnerability in include.php in Noah's Classifieds 1.3 allows remote attackers to include arbitrary local files via the otherTemplate parameter to index.php...

CVE-2006-0880

Multiple cross-site scripting XSS vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 inf parameter; or, when registerglobals is enabled, the 2 upperTemplate and 3 lowerTemplate parameters...

CVE-2006-0878

Noah's Classifieds 1.3 allows remote attackers to obtain the installation path via a direct request to include files, as demonstrated by classifieds/gorum/category.php...

CVE-2006-0882

CVE-2006-0882 governs a directory traversal vulnerability in Noah’s Classifieds 1.3, where an attacker can cause index.php to include arbitrary local files via the otherTemplate parameter in include.php. This confirms a remote access impact through file inclusion. The available documents identify...

CVE-2006-0879

CVE-2006-0879 describes an SQL injection vulnerability in the search tool of Noah’s Classifieds 1.3. The vulnerability allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors. The NVD entry lists a high base score (7.5) with network attack vector and no authentica...

CVE-2006-0881

Multiple PHP remote file include vulnerabilities in gorum/gorumlib.php in Noah's Classifieds 1.3, when registerglobals is enabled, allow remote attackers to include arbitrary PHP files via the 1 upperTemplate and 2 lowerTemplate parameters, as demonstrated using the lowerTemplate parameter to...

CVE-2006-0880

Multiple cross-site scripting XSS vulnerabilities in index.php in Noah's Classifieds 1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 inf parameter; or, when registerglobals is enabled, the 2 upperTemplate and 3 lowerTemplate parameters...

CVE-2006-0879

SQL injection vulnerability in the search tool in Noah's Classifieds 1.3 allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors...

CVE-2006-0878

Noah's Classifieds 1.3 is affected by a path disclosure vulnerability in which remote attackers can obtain the installation path via a direct request to include files (example: classifieds/gorum/category.php). The root cause is a file inclusion/path traversal issue that exposes server paths. Vers...

CVE-2006-0880

CVE-2006-0880 – The Noah’s Classifieds 1.3 PHP application is vulnerable to multiple XSS flaws in index.php. Attackers can inject arbitrary script/HTML via the (1) inf parameter, and, if PHP register_globals is enabled, via the (2) upperTemplate and (3) lowerTemplate parameters. The description d...

CVE-2006-0882

Directory traversal vulnerability in include.php in Noah's Classifieds 1.3 allows remote attackers to include arbitrary local files via the otherTemplate parameter to index.php...

CVE-2006-0878

Noah's Classifieds 1.3 allows remote attackers to obtain the installation path via a direct request to include files, as demonstrated by classifieds/gorum/category.php...

CVE-2006-0881

CVE-2006-0881 concerns Noah’s Classifieds 1.3, where the PHP file gorum/gorumlib.php is vulnerable to remote file inclusion when PHP register_globals is enabled. The vulnerability enables an attacker to compel the application to include arbitrary PHP files by manipulating the upperTemplate or low...