Sql injection

SQL injection vulnerability in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domaininfo.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272...

CVE-2011-3196

The CVE-2011-3196 issue affects Domain Technologie Control (DTC) prior to version 0.34.1. The root cause is world-readable permissions on /etc/apache2/apache2.conf, which allowed local users to read a configuration file and obtain the dtcdaemons MySQL password. Impact was local, with confidential...

CVE-2011-5276: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the drawAdminToolsPackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control DTC before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the databasename parameter...

CVE-2011-3198: Undefined Security Weakness

Domain Technologie Control DTC before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments...

CVE-2011-5275: Undefined Security Weakness

The install script in Domain Technologie Control DTC before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it easier for context-dependent users to gain privileges...

CVE-2011-5273: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in shared/package-installer in Domain Technologie Control DTC before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. dot dot in the pkg parameter in a doinstall action to dtc/...

CVE-2011-0437

shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control DTC before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edsshaccount parameter in a deletesshaccount Delete action...

CVE-2011-0437: Undefined Security Weakness

shared/inc/sql/ssh.php in the SSH accounts management implementation in Domain Technologie Control DTC before 0.32.9 allows remote authenticated users to delete arbitrary accounts via the edsshaccount parameter in a deletesshaccount Delete action...

CVE-2011-0435: Improper Authentication

Domain Technologie Control DTC before 0.32.9 does not require authentication for 1 admin/bwpermonth.php and 2 client/bwpermonth.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request...

CVE-2011-0434: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Domain Technologie Control DTC before 0.32.9 allow remote attackers to execute arbitrary SQL commands via the cid parameter to 1 admin/bwpermonth.php or 2 client/bwpermonth.php...

CVE-2011-0436: Undefined Security Weakness

The registeruser function in client/newaccountform.php in Domain Technologie Control DTC before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...

CVE-2009-0402: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in client/newaccount.php in Domain Technologie Control DTC before 0.29.16 allows remote attackers to execute arbitrary SQL commands via the 1 familyname, 2 christname, 3 companyname, 4 iscompany, 5 email, 6 phone, 7 fax, 8 addr1, 9 addr2, 10 addr3, 11 zipcode, 12 city,...