XSRF (CSRF) in CMSimple

Vulnerability ID: HTB22561 Reference: http://www.htbridge.ch/advisory/xsrfcsrfincmsimple.html Product: CMSimple Vendor: Peter Andreas Harteg http://www.cmsimple.org/ Vulnerable Version: 3.3 and Probably Prior Versions Vendor Notification: 02 August 2010 Vulnerability Type: CSRF Cross-Site Request...

CMSimple 3.3 - Cross-Site Scripting / Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/42470/info CMSimple is prone to multiple cross-site scripting vulnerabilities and a cross-site request-forgery vulnerability. An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the...

CMSimple 3.3 - Cross-Site Scripting Cross-Site Request Forgery

CMSimple 3.3 - Cross-Site Scripting Cross-Site Request Forgery source: https://www.securityfocus.com/bid/42470/info CMSimple is prone to multiple cross-site scripting vulnerabilities and a cross-site request-forgery vulnerability. An attacker can exploit these vulnerabilities to execute arbitrary...

Multiple Vulnerabilities in CMSimple

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in CMSimple which could be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-site scripting XSS vulnerabilities in CMSimple The vulnerability exists due to input sanitation...

Directory traversal

Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.ph...

CVE-2008-2650

Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.ph...

CVE-2008-2650

Directory traversal vulnerability in cmsimple/cms.php in CMSimple 3.1, when registerglobals is enabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including adm.ph...

CVE-2008-2650

CMSimple 3.1 is vulnerable to Local File Inclusion in cmsimple/cms.php when register_globals is enabled. An attacker can use a .. in the sl parameter to index.php to include and execute arbitrary local files, potentially enabling remote code execution by including adm.php and calling the upload a...

CMSimple文件上传及本地文件包含漏洞

BUGTRAQ ID: 29450 CMSimple是基于PHP的小型网站内容管理工具。 CMSimple的index.php脚本中没有正确地过滤对sl参数的输入便用于包含本地文件；index.php脚本没有正确地限制对登录用户的访问，可能导致上传任意文件并执行任意PHP代码。成功利用这些漏洞要求打开了registerglobals。 CMSimple 3.1 CMSimple -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.cmsimple.org/?Downloads:Securityfix...

CMSimple 3.1 Local File Inclusion / Arbitrary File Upload Exploit

No description provided by source. pre CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion : http://host/path/index.php?sl=file%00...

cmsimple-lfiup.txt

CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion : http://host/path/index.php?sl=file%00...

CMSimple 3.1 - Local File Inclusion Arbitrary File Upload

CMSimple 3.1 - Local File Inclusion Arbitrary File Upload CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion :...

CMSimple 3.1 Local File Inclusion / Arbitrary File Upload Exploit

Exploit for unknown platform in category web applications ================================================================= CMSimple 3.1 Local File Inclusion / Arbitrary File Upload Exploit ================================================================= CMSimple 3.1 Local File Inclusion /...

CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload

CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion : http://host/path/index.php?sl=file%00...

CVE-2007-0610

Cross-site scripting XSS vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0610

Cross-site scripting XSS vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0610

CVE-2007-0610 affects CMSimple 2.7 fix1 in the mailform component. The vulnerability is a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the sender parameter. The available documentation attributes the issue to the mailform feature, and the...

CVE-2007-0551

Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pthfileconfig and 2 pthfileimage parameters...

CVE-2007-0551

Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pthfileconfig and 2 pthfileimage parameters...