OneCMS load参数本地文件包含漏洞

BUGTRAQ ID: 29374 OneCMS是为网络游戏站点设计的内容管理系统。 OneCMS实现上存在输入验证漏洞，远程攻击者可以通过提交恶意的HTTP请求包含本地资源的任意文件，导致泄露敏感信息。 当act设置为go的时候，OneCMS的installmod.php文件中没有正确过滤对load参数的输入便用于包含文件： $mod = $GET'load'; $filexp = explode".", $mod; $filetype = $filexp1; $file = $filexp0; $file2 = "mods/$mod"; if !isnumeric$mod...

xomol-bypasslfi.txt

'/ -.- -------------oOO------OOo------------ | Xomol CMS v1 Login Bypass & LFI | | coded by DNX | ---------------------------------------- ! Discovered.: DNX ! Vendor.....: http://www.xomol.net ! Detected...: 12.05.2008 ! Reported...: 13.05.2008 didn't work: host mail.xomol.net said: 554 5.7.1 -...

Debian DSA-1580-1 : phpgedview - programming error

It was discovered that phpGedView, an application to provide online access to genealogical data, allowed remote attackers to gain administrator privileges due to a programming error. Note: this problem was a fundamental design flaw in the interface API to connect phpGedView with external programs...

DSA-1580-1 phpgedview - privilege escalation

Bulletin has no description...

smeego-lfi.txt

Smeego CMS Local File Include Exploit by 0in from Dark-Coders Programming & Security Group http://dark-coders.4rh.eu File: mainfile.php if $displayerrors == 1 // We don't se any errors ; @iniset'displayerrors', 1; else @iniset'displayerrors', 0; if isset$newlang if...

Smeego 1.0 (Cookie lang) Local File Inclusion Exploit

No description provided by source. Smeego CMS Local File Include Exploit by 0in from Dark-Coders Programming & Security Group http://dark-coders.4rh.eu -------------------------------------------------------- Contact: 0indotemailatgmaildotcom ------------------------------------------------------...

Smeego 1.0 (Cookie lang) Local File Inclusion Exploit

Exploit for unknown platform in category web applications ===================================================== Smeego 1.0 Cookie lang Local File Inclusion Exploit ===================================================== Smeego CMS Local File Include Exploit by 0in from Dark-Coders Programming &...

CVE-2008-2217

Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attackers to include and execute arbitrary local files via a .. dot dot in the cmimgpath parameter...

CVE-2008-2217

Directory traversal vulnerability in cm/graphie.php in Content Management System 0.6.1 for Phprojekt allows remote attackers to include and execute arbitrary local files via a .. dot dot in the cmimgpath parameter...

CVE-2008-2217

CVE-2008-2217 affects Phprojekt’s Content Management System 0.6.1, with a vulnerability in cm/graphie.php that allows directory traversal via the cm_imgpath parameter. An attacker can use ".." to include and execute arbitrary local files. This is a remote, unauthenticated risk with potential impa...

CVE-2008-2186

Cross-site scripting XSS vulnerability in index.php in Chilek Content Management System aka ChiCoMaS 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the q parameter...

Phoenix View CMS Pre Alpha2 - SQL Injection / Local File Inclusion / Cross-Site Scripting

Phoenix View CMS = Pre Alpha2 Multiple Vulnerabilities LFISQLIXSS Found by : tw8 Date : 8.05.2008 Website && Forum : http://rstzone.org && http://rstzone.org/forum/ Bug type : LFI, SQLI & XSS Affected software description: Application : Phoenix View CMS Version : = Pre Alpha2 Vendor :...

Phoenix View CMS <= Pre Alpha2 (SQL/LFI/XSS) Multiple Vulnerabilities

Exploit for unknown platform in category web applications ===================================================================== Phoenix View CMS = Pre Alpha2 SQL/LFI/XSS Multiple Vulnerabilities ===================================================================== Phoenix View CMS = Pre Alpha2...

CVE-2008-2064

Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and attack vectors related to "a fundamental design flaw in the interface API to connect phpGedView with external programs like content management systems."...

CVE-2008-2064

Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and attack vectors related to "a fundamental design flaw in the interface API to connect phpGedView with external programs like content management systems."...

Design/Logic Flaw

Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and attack vectors related to "a fundamental design flaw in the interface API to connect phpGedView with external programs like content management systems."...

CVE-2008-2064

Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and attack vectors related to "a fundamental design flaw in the interface API to connect phpGedView with external programs like content management systems."...

CVE-2008-2016

PHP remote file inclusion vulnerability in Chilek Content Management System aka ChiCoMaS 2.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter to the default URI under install/. NOTE: this can also be leveraged to include and execute arbitrary local files via...

CVE-2008-2017

The CVE-2008-2017 entry concerns Chilek Content Management System (ChiCoMaS) 2.0.4, where a directory traversal flaw allows remote attackers to include and execute arbitrary local files. The vulnerability arises from a dot-dot sequence (..) in the operation parameter to the default install/ URI. ...

CVE-2008-2016

PHP remote file inclusion vulnerability in Chilek Content Management System aka ChiCoMaS 2.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the lang parameter to the default URI under install/. NOTE: this can also be leveraged to include and execute arbitrary local files via...