CMSimple文件上传及本地文件包含漏洞

BUGTRAQ ID: 29450 CMSimple是基于PHP的小型网站内容管理工具。 CMSimple的index.php脚本中没有正确地过滤对sl参数的输入便用于包含本地文件；index.php脚本没有正确地限制对登录用户的访问，可能导致上传任意文件并执行任意PHP代码。成功利用这些漏洞要求打开了registerglobals。 CMSimple 3.1 CMSimple -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.cmsimple.org/?Downloads:Securityfix...

CMSimple 3.1 Local File Inclusion / Arbitrary File Upload Exploit

No description provided by source. pre CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion : http://host/path/index.php?sl=file%00...

cmsimple-lfiup.txt

CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion : http://host/path/index.php?sl=file%00...

CMSimple 3.1 Local File Inclusion / Arbitrary File Upload Exploit

Exploit for unknown platform in category web applications ================================================================= CMSimple 3.1 Local File Inclusion / Arbitrary File Upload Exploit ================================================================= CMSimple 3.1 Local File Inclusion /...

CMSimple 3.1 - Local File Inclusion Arbitrary File Upload

CMSimple 3.1 - Local File Inclusion Arbitrary File Upload CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion :...

CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload

CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: "Powered by CMSimple" author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion : http://host/path/index.php?sl=file%00...

CVE-2007-0610

Cross-site scripting XSS vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0610

Cross-site scripting XSS vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0610

CVE-2007-0610 affects CMSimple 2.7 fix1 in the mailform component. The vulnerability is a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the sender parameter. The available documentation attributes the issue to the mailform feature, and the...

CVE-2007-0610: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the mailform feature in CMSimple 2.7 fix1 allows remote attackers to inject arbitrary web script or HTML via the sender parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2007-0551

Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pthfileconfig and 2 pthfileimage parameters...

CVE-2007-0551

Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pthfileconfig and 2 pthfileimage parameters...

CVE-2007-0551

CMSimple 2.7 is affected by CVE-2007-0551 via multiple PHP remote file inclusion vulnerabilities in cms.php, allowing an attacker to execute arbitrary PHP code through the pth[file][config] or pth[file][image] parameters. The issue stems from including user-supplied URLs, enabling code execution ...

CVE-2007-0551: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in cmsimple/cms.php in CMSimple 2.7 allow remote attackers to execute arbitrary PHP code via a URL in the 1 pthfileconfig and 2 pthfileimage parameters...

cmsimple27-rfi.txt

----------------------------------------------- cmsimple 2.7 Remote File Include ----------------------------------------------- Author: Alkmandz ----------------------------------------------- Vuln Code: if !@ include $pth'file''pluginindex' if@include$pth'file''image'exit;...

cmsimple 2.7 Remote File Include

----------------------------------------------- cmsimple 2.7 Remote File Include ----------------------------------------------- Author: Alkmandz ----------------------------------------------- Vuln Code: if !@ include $pth'file''pluginindex' if@include$pth'file''image'exit;...

CMSimple Cross Site Scripting

Aria-Security.net Advisory Discovered by: OUTLAW www.Aria-security.net Gr33t to: A.u.r.a & l2odon & R@1D3N @ DrtRp & Cl0wn Software: CMSimple Attack method: Cross Site Scripting Original advisory:http://www.aria-security.net/advisory/cmsimple.txt Proof of Concept: Search in:...

CMSimple 'index.php?search' XSS Vulnerability - Active Check

CMSimple is prone to cross-site scripting XSS attacks due to its failure to sanitize user-supplied input to the search field. SPDX-FileCopyrightText: 2006 Josh Zlatin-Amishav Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CMSimple Guestbook Module index.php XSS

The remote host is running CMSimple, a CMS written in PHP. The version of CMSimple installed on the remote host is prone to cross-site scripting attacks due to its failure to sanitize user-supplied input to both the search and guestbook modules. %NASLMINLEVEL 70300 Josh Zlatin-Amishav josh at ram...