drakecms-sql.txt

gid 17. if '' === $gbname = in'gbname', SQL | NOHTML, $POST, '', 50 18. || '' === $gbemail = in'gbemail', SQL | NOHTML, $POST, '', 50 19. || !isemail$gbemail 20. 21. CMSResponse::BackFORMNC; 22. else 23. $gbname = $my-name; 24. $gbemail = $my-email; 25. 26. 27. $timeout = $params-get'timeout',5;...

Drake CMS <= 0.4.11 Remote Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ====================================================== Drake CMS gid 17. if '' === $gbname = in'gbname', SQL | NOHTML, $POST, '', 50 18. || '' === $gbemail = in'gbemail', SQL | NOHTML, $POST, '', 50 19. || !isemail$gbemail 20. 21...

Path traversal

Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the droot parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-1371

Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the droot parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-1371

CVE-2008-1371 affects Drake CMS 0.4.11 RC8 via an absolute path traversal in install/index.php, exploitable through a full pathname supplied in the d_root parameter. This allows remote attackers to read and execute arbitrary files. The description notes provenance as third-party information; no r...

CVE-2008-1371

Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the droot parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2008-1371: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in install/index.php in Drake CMS 0.4.11 RC8 allows remote attackers to read and execute arbitrary files via a full pathname in the droot parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

Drake CMS 0.4.11 RC8 - d_root Local File Inclusion

Drake CMS 0.4.11 RC8 - droot Local File Inclusion source: https://www.securityfocus.com/bid/28165/info Drake CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute...

Drake CMS 0.4.11 RC8 - 'd_root' Local File Inclusion

source: https://www.securityfocus.com/bid/28165/info Drake CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. Exploiting this issue may allow an unauthorized user to view files and execute local scripts. Drake CMS 0.4.11RC8 is vulnerable;...

CVE-2007-6695

Cross-site scripting XSS vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter...

CVE-2007-6695

Cross-site scripting XSS vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter...

CVE-2007-6695

CVE-2007-6695: Drake CMS 0.4.9 has an XSS in index.php via the option parameter. Root cause is insufficient input sanitization, allowing arbitrary script/HTML injection in victim browsers. Exploitation details are present (Exploit-DB entry with example payload); no remediation or patch informatio...

CVE-2007-6695

Cross-site scripting XSS vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter...

CVE-2007-6695: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter...

Drake CMS 0.4.9 - 'index.php' Cross-Site Scripting Vulnerability

Drake CMS 0.4.9 'index.php' Cross-Site Scripting Vulnerability. CVE-2007-6695. Webapps exploit for php platform source: http://www.securityfocus.com/bid/27459/info Drake CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An...

Crlf injection

CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We d...

CVE-2007-2618

CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We d...

CVE-2007-2618

The CVE-2007-2618 issue affects Drake CMS 0.4.0, identifying a CRLF injection vulnerability in index.php. The root cause is a CRLF sequence in the lang parameter that enables an attacker to inject arbitrary HTTP headers and perform HTTP response splitting. Public details describe the vulnerable c...

CVE-2007-2618

CRLF injection vulnerability in index.php in Drake CMS 0.4.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the lang parameter. NOTE: Drake CMS has only a beta version available, and the vendor has previously stated "We d...