CMScout 2.05 - bit Local File Inclusion

CMScout 2.05 - bit Local File Inclusion CMScout 2.05 LFI AUTHOR : IRCRASH R3d.W0rm Discovered by : IRCRASH R3d.W0rm Our Site : Http://IRCRASH.COM IRCRASH Team Members : Dr.Crash - R3d.w0rm Script Download : www.cmscout.co.za DORK : "Powered by CMScout ©2005 CMScout Group" Lfi...

CVE-2007-3650

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

Design/Logic Flaw

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

CVE-2007-3650

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

CVE-2007-3650: Exposure of Sensitive Information to an Unauthorized Actor

myWebland myBloggie 2.1.6 allow remote attackers to obtain sensitive information via 1 an invalid year parameter to calendar.php, reached through index.php; 2 a direct request to common.php; and 3 a mode array parameter in the query string to login.php, which reveal the installation path in vario...

CVE-2007-6079: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in include/common.php in bcoos 1.0.10 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the xoopsOptionpagetype parameter to the default URI for modules/news/. NOTE: this can be leveraged by using legitimate product...

CVE-2007-5843: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/common.php in scWiki 1.0 Beta 2 allows remote attackers to execute arbitrary PHP code via a URL in the pathdot parameter...

scwiki-rfi.txt

scWiki 1.0 Beta 2 common.php pathdot Remote File Inclusion Vulnerability http://heanet.dl.sourceforge.net/sourceforge/sc-wiki/scwikibeta2.zip POC : /includes/common.php?pathdot=Shell...

scWiki Common.PHP远程文件包含漏洞

scWiki是一款基于PHP的WEB应用程序。 scWiki不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题是由于'Common.PHP'脚本对用户提交的'pathdot'参数缺少过滤，指定远程服务器上的任意文件作为包含参数，可导致以WEB权限执行任意PHP代码。 scWiki scWiki 1.0 beta 2 目前没有详细解决方案提供： http://sourceforge.net/projects/sc-wiki/ http://www.example.com/path/includes/common.php?pathdot=Shell...

scWiki 1.0 Beta 2 - common.php?pathdot Remote File Inclusion

scWiki 1.0 Beta 2 - common.php?pathdot Remote File Inclusion scWiki 1.0 Beta 2 common.php pathdot Remote File Inclusion Vulnerability http://heanet.dl.sourceforge.net/sourceforge/sc-wiki/scwikibeta2.zip POC : /includes/common.php?pathdot=Shell milw0rm.com 2007-11-03...

CVE-2007-5727: Improper Neutralization of Input During Web Page Generation

Incomplete blacklist vulnerability in the stripScripts function in common.php in OneOrZero Helpdesk 1.6.5.4, 1.6.4.2, and possibly other versions, allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary web script or HTML via XSS sequences without SCRIPT tags in t...

CVE-2003-1467: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 login.php, 2 register.php, 3 post.php, and 4 common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors...

CVE-2007-5315: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in common.php in LiveAlbum 0.9.0, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the livealbumdir parameter...

Sql injection

Multiple SQL injection vulnerabilities in wolioCMS allow remote attackers to execute arbitrary SQL commands via 1 the id parameter to member.php in a page action, related to a SELECT statement in common.php; and the 2 loginid parameter uid variable, and possibly the 3 pwd parameter, to...

wolioCMS Auth Bypass / Remote SQL Injection Vulnerabilities

No description provided by source. wolioCMS - SQL Injection and Bypass Administrator Login Vendor : http://www.buton.web.id/member.php?member=anon Download : http://www.buton.web.id/download/woliocms.zip Found By : k1tk4t - k1tk4t4tnewhack.org Location : Indonesia -- newhackdotorg @irc.dal.net...

woliocms-sql.txt

wolioCMS - SQL Injection and Bypass Administrator Login Vendor : http://www.buton.web.id/member.php?member=anon Download : http://www.buton.web.id/download/woliocms.zip Found By : k1tk4t - k1tk4t4tnewhack.org Location : Indonesia -- newhackdotorg @irc.dal.net Exploit ini berhasil jika...

netclassifieds-multi.txt

Application: NetClassifieds version: -Free Edition -Standard Edition -Professional Edition -Premium Edition Web Site: http://www.scriptdevelopers.net/ Versions: all Platform: linux, windows Bug: multiple injection sql , xss , full path Fix Available: Yes...

Design/Logic Flaw

NetClassifieds Premium Edition allows remote attackers to obtain sensitive information via certain requests that reveal the path in an error message, related to the displayerrors setting in 1 Common.php and 2 imageresizer.php, and 3 the use of FILE in error reporting by imageresizer.php; and 4 vi...

NetClassifieds (SQL/XSS/Full Path) Multiple Remote Vulnerabilities

Exploit for unknown platform in category web applications ================================================================== NetClassifieds SQL/XSS/Full Path Multiple Remote Vulnerabilities ================================================================== Application: NetClassifieds: -Free Editi...

NetClassifieds - SQL Injection Cross-Site Scripting Full Path

NetClassifieds - SQL Injection Cross-Site Scripting Full Path Application: NetClassifieds: -Free Edition -Standard Edition -Professional Edition -Premium Edition Web Site: http://www.scriptdevelopers.net/ Versions: all Platform: linux, windows Bug: multiple injection sql , xss , full path Fix...