Advanced Electron Forums 1.0.9 Cross Site Request Forgery

Advanced Electron Forums AEF 1.0.9 = Cross Site Request Forgery CSRF Vulnerability 1. OVERVIEW The Advanced Electron Forums AEF 1.0.9 = versions are vulnerable to Cross Site Request Forgery CSRF. 2. BACKGROUND AEF has a very simple and easy to use Administration Panel and installing this software...

CVE-2011-3700

Advanced Electron Forum AEF 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopiclang.php...

Information disclosure

Advanced Electron Forum AEF 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopiclang.php...

CVE-2011-3700

Advanced Electron Forum AEF 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopiclang.php...

CVE-2011-3700

Vulnerability: CVE-2011-3700 in Advanced Electron Forum (AEF) 1.0.8. Issue: Remote attackers can disclose sensitive information by making a direct request to a PHP file (languages/english/deletetopic_lang.php), causing an error message that reveals the installation path. Impact: Information discl...

CVE-2009-2545

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Sql injection

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2545

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2546

Directory traversal in Advanced Electron Forum (AEF) 1.x allows remote attackers to determine whether arbitrary files exist via the avatargalfile parameter when changing an avatar, causing information disclosure through error messages. No patch or remediation is stated in the provided documents.

CVE-2009-2545

CVE-2009-2545 describes an SQL injection in Advanced Electron Forum (AEF) 1.x when magic_quotes_gpc is disabled. The vulnerability allows remote attackers to inject arbitrary SQL through the filename field of an uploaded attachment. The available documents confirm the affected software and the un...

CVE-2008-5090

Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the pregreplace function with the eval switch...

Code injection

Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the pregreplace function with the eval switch...

CVE-2008-5090

The CVE-2008-5090 entry affects Electron Inc. Advanced Electron Forum versions prior to 1.0.7. The vulnerability arises when PHP code embedded in bbcode within the email parameter is processed by preg_replace with the eval switch, allowing remote attackers to execute arbitrary PHP code. This desc...

CVE-2008-5090

Electron Inc. Advanced Electron Forum before 1.0.7 allows remote attackers to execute arbitrary PHP code via PHP code embedded in bbcode in the email parameter, which is processed by the pregreplace function with the eval switch...

Advanced Electron Forum <= 1.0.6 Remote Code Execution Vulnerability

No description provided by source. GulfTech Security Research September 20, 2008 Vendor : Electron Inc. URL : http://www.anelectron.com/ Version : AEF Forum = 1.0.6 Risk : Remote Code Execution Description: Advanced Electron Forum also known as AEF Forum is a full featured online forum system...

advancedelectron-exec.txt

GulfTech Security Research September 20, 2008 Vendor : Electron Inc. URL : http://www.anelectron.com/ Version : AEF Forum = 1.0.6 Risk : Remote Code Execution Description: Advanced Electron Forum also known as AEF Forum is a full featured online forum system written in php that allows webmasters...

Advanced Electron Forum <= 1.0.6 Remote Code Execution Vulnerability

Exploit for unknown platform in category web applications ==================================================================== Advanced Electron Forum = 1.0.6 Remote Code Execution Vulnerability ==================================================================== GulfTech Security Research...

Advanced Electron Forum 1.0.6 - Remote Code Execution

GulfTech Security Research September 20, 2008 Vendor : Electron Inc. URL : http://www.anelectron.com/ Version : AEF Forum = 1.0.6 Risk : Remote Code Execution Description: Advanced Electron Forum also known as AEF Forum is a full featured online forum system written in php that allows webmasters...

CVE-2008-1983

Cross-site scripting XSS vulnerability in Advanced Electron Forum AEF 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Advanced Electron Forum AEF 1.0.6 allows remote attackers to inject arbitrary web script or HTML via the beg parameter in a members action to index.php...