All In One Control Panel SQL注入漏洞

All In One Control Panel是一款基于PHP的WEB应用程序。 All In One Control Panel不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是多个脚本对用户提交的WEB参数缺少过滤，提交恶意脚本代码作为参数数据，可导致获得敏感信息。 AIOCP AIOCP 1.3.9 AIOCP AIOCP 1.3.7 AIOCP AIOCP 1.3.6 AIOCP AIOCP 1.3.5 AIOCP AIOCP 1.3.4 目前没有解决方案提供： http://sourceforge.net/projects/aiocp/...

Sql injection

SQL injection vulnerability in shared/code/cpfunctionsdownloads.php in Nicola Asuni All In One Control Panel AIOCP before 1.3.009 allows remote attackers to execute arbitrary SQL commands via the downloadcategory parameter...

CVE-2007-0223

SQL injection vulnerability in shared/code/cpfunctionsdownloads.php in Nicola Asuni All In One Control Panel AIOCP before 1.3.009 allows remote attackers to execute arbitrary SQL commands via the downloadcategory parameter...

All In One Control Panel 1.3.x - 'cp_downloads.php?did' SQL Injection

source: https://www.securityfocus.com/bid/22032/info All In One Control Panel is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the...

[SA23726] All In One Control Panel "download_category" SQL Injection

TITLE: All In One Control Panel "downloadcategory" SQL Injection SECUNIA ADVISORY ID: SA23726 VERIFY ADVISORY: http://secunia.com/advisories/23726/ CRITICAL: Moderately critical IMPACT: Manipulation of data WHERE: From remote SOFTWARE: All In One Control Panel 1.x http://secunia.com/product/12505...

CVE-2006-6566

PHP remote file inclusion vulnerability in includes/profilcpconstants.php in the Profile Control Panel CPanel module for mxBB 0.91c allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...

EUVD-2006-6549

PHP remote file inclusion vulnerability in includes/profilcpconstants.php in the Profile Control Panel CPanel module for mxBB 0.91c allows remote attackers to execute arbitrary PHP code via a URL in the modulerootpath parameter...

AR Memberscript - usercp_menu.php Remote File Inclusion

AR Memberscript - usercpmenu.php Remote File Inclusion Author: ex0 armemberscript - remote file include vulnerability all versions There is no vendo patch, and doubt there will be. I havnt been able to get in touch with the vendor for 2 months armemberscript is a script used by many anime sites t...

mxBB Module Profile Control Panel 0.91c Remote File Include Vulnerability

mxBB Module Profile Control Panel 0.91c Remote File Include Vulnerability Bugfound3R: bd0rk || SOH-Crew Website: www.soh-crew.it.tt Greetz: str0ke, Lu7k, TheJT, Natok Download: http://www.mx-system.com/modules/mxpafiledb/dload.php?action=download&fileid=70 == Vulnerable Code in...

MXBB Profile Control Panel 0.91c - Module Remote File Inclusion

MXBB Profile Control Panel 0.91c - Module Remote File Inclusion source: https://www.securityfocus.com/bid/21520/info The mxBB profile Control Panel module is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this...

mxBB Module Profile CP 0.91c Remote File Include Vulnerability

No description provided by source. mxBB Module Profile Control Panel 0.91c Remote File Include Vulnerability Bugfound3R: bd0rk || SOH-Crew Website: www.soh-crew.it.tt Greetz: str0ke, Lu7k, TheJT, Natok Download: http://www.mx-system.com/modules/mxpafiledb/dload.php?action=download&fileid=70 ==...

H-Sphere Control Panel不安全日志文件权限漏洞

H-Sphere Control Panel是多域名/站点管理控制面板程序。 域名/站点管理不安全日志文件权限问题，本地攻击者可以利用漏洞破坏系统文件，造成拒绝服务或特权提升问题。 目前没有详细漏洞细节提供。 Positive Software H-Sphere 2.4.3 http://www.psoft.net/hsphere2info.html...

CVE-2006-6382

The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack. NOTE: The provenance of this information is unknown; the details are obtained...

CVE-2006-5984

Multiple cross-site scripting XSS vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the 1 txtCompanyName, 2 txtEmail, or 3 txtUserAccNum parameter to a users.asp, or the 4 setThemeColour parameter to b default.asp ...

CVE-2006-5984

Helm Web Hosting Control Panel 3.2.10 is affected by CVE-2006-5984: multiple XSS weaknesses in the Admin, Reseller, and User levels. The vectors include user input in (1) txtCompanyName, (2) txtEmail, (3) txtUserAccNum to users.asp; (4) setThemeColour to default.asp (Reseller/Admin) and (5) setTh...

CVE-2006-5984

Multiple cross-site scripting XSS vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the 1 txtCompanyName, 2 txtEmail, or 3 txtUserAccNum parameter to a users.asp, or the 4 setThemeColour parameter to b default.asp ...

vBulletin 3.6.x - Admin Control Panel Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/21157/info vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker could exploit this vulnerability to have arbitrary script code execute in the context of the...

CVE-2006-5831

PHP remote file inclusion vulnerability in admin/code/index.php in All In One Control Panel AIOCP 1.3.007 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the loadpage parameter...

CVE-2006-5830

Multiple cross-site scripting XSS vulnerabilities in All In One Control Panel AIOCP 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 topid, 2 forid, and 3 catid parameters to code/cpforumview.php; 4 choosedlanguage parameter to cpdpage.php; 5 orderdir...

CVE-2006-5830

CVE-2006-5830 details multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier. The issue arises from unsanitized input in several parameters and fields, including: (1) topid, (2) forid, (3) catid to code/cp_forum_view.php; (4) choosed_language t...